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Abstract 


The  purpose  of  this  research  is  to  determine  whether  there  are  differences  in 
perceptions  between  approving  officials  (AOs)  and  cardholders  (CHs)  regarding 
internal  controls  within  the  Government  Purchase  Card  Program  (GPCP)  at  the 
Naval  Postgraduate  School  (NPS).  A  main  component  of  the  research  is  a  voluntary 
and  anonymous  online  survey  deployed  to  the  AOs  and  CHs  at  NPS.  Results  from 
the  analysis  of  the  survey  data  can  be  used  to  identify  areas  of  improvement  within 
the  GPCP. 

Based  on  the  data  analysis,  there  were  eight  significant  differences  in 
perceptions  of  internal  controls  between  AOs  and  CHs.  They  were  identified  in  three 
of  the  five  internal  control  components;  risk  assessment,  information  and 
communication,  and  monitoring  activities.  The  data  analysis  revealed  that  AOs 
generally  responded  more  positively  than  CHs,  implying  that  AOs  may  perceive  the 
strength  of  the  GPCP’s  internal  controls  to  be  stronger  than  the  CHs  perceive  them. 
In  addition,  there  were  survey  items  to  which  both  AOs  and  CHs  responded  strongly, 
which  included  such  things  as  password  protection,  separation  of  duties,  and 
adequate  fraud  education.  Both  strong  and  weak  internal  controls  have  implications 
on  auditability.  The  analysis  identified  potential  implications  of  internal  controls,  or 
lack  thereof,  on  auditability  within  the  GPCP  at  NPS. 

Keywords:  P-Card,  purchase  card,  commercial  card,  government  purchase 
card  program,  auditability,  audit  readiness,  internal  controls,  COSO 
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I.  INTRODUCTION 


In  this  chapter,  the  background  and  purpose  of  this  research  are  presented, 
and  the  research  questions  are  addressed.  The  benefits  and  limitations,  in  addition 
to  the  importance  of  this  research,  are  also  discussed.  Finally,  the  methodology  is 
briefly  outlined,  and  the  scope  and  organization  of  the  research  are  presented. 

A.  BACKGROUND 

The  Department  of  Defense  (DoD)  and  the  Department  of  the  Navy  (DoN) 
purchase  card  programs  process  hundreds  of  thousands  of  transactions  accounting 
for  billions  of  dollars  annually.  In  2013,  the  federal  government’s  300,900 
cardholders  (CHs)  spent  $16.5  billion  on  18.9  million  transactions  (General  Services 
Administration  [GSA],  n.d.-c).  The  Government  Purchase  Card  Program  (GPCP) 
was  developed  as  a  tool  to  support  streamlining  initiatives  and  was  intended  to  have 
cost  savings  applications  in  the  federal  government,  the  DoD,  DoN,  and  the  Naval 
Postgraduate  School  (NPS).  The  purchase  card  is  used  in  many  organizations  to 
streamline  the  procurement  process. 

Following  Executive  Order  12,931  (1982)  to  reduce  costs  as  well  as  the 
successful  pilot  phase  for  a  purchase  card  program  in  1986,  the  federal  government 
began  the  use  of  a  government-wide  purchase  card  program  in  1989.  Although  the 
program  was  somewhat  successful,  because  of  the  weak  internal  controls  and 
misuse  over  time,  additional  legislative  actions  were  put  in  place,  and  the  program 
evolved  over  the  years.  In  1998,  the  GSA  SmartPay  Program  was  established  “to 
serve  as  the  premiere  charge  card  program  for  the  United  States  federal 
government,  serving  more  than  350  federal  agencies  and  organizations”  (GSA, 
2012).  In  2008,  the  federal  government  spent  $30.6  billion  on  the  commercial  card, 
which  includes  the  travel,  fleet,  and  purchase  cards,  and  65%  of  that  was  spent  on 
the  purchase  card  alone  (Palmer,  Gupta,  &  Dawson,  2010). 

The  GPCP  directives  provide  very  specific  rules,  regulations,  and 
responsibilities  for  all  key  personnel,  including  approving  officials  (AOs)  and  CFIs,  in 
order  to  maintain  proper  training,  follow  capable  processes,  and  implement  effective 
internal  controls  (Rendon  &  Rendon,  2014).  The  DoD  is  tasked  with  being  auditable 
by  2017;  therefore,  the  program’s  specific  requirements  are  crucial  in  the  current 
fiscal  environment.  Recent  requirements  for  strong  internal  controls  and  the 
Managers’  Internal  Control  Program  (MICP)  need  to  be  implemented  to  ensure 
organizations  are  in  compliance  with  internal  control  directives  and  policies. 

The  GPCP  at  NPS  provides  a  “fast  and  convenient  method  to  pay  for  all 
requirements  under  the  micro  purchase-threshold”  (Naval  Postgraduate  School 
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[NPS],  2012,  p.  1)  of  $3,000  for  civilian  and  military  personnel.  In  fiscal  year  (FY) 
2012,  the  NPS  GPCP  processed  approximately  21,000  transactions  that  accounted 
for  approximately  $24  million  (M.  Morales,  personal  communication,  July  24,  2013). 
Although  the  GPCP  may  be  convenient  and  realize  costs  savings,  an  analysis  of  the 
perceived  internal  controls  and  implications  to  auditability  is  warranted  to  ensure 
compliance  with  established  internal  control  policies  and  procedures. 

B.  PURPOSE  OF  RESEARCH 

The  purpose  of  this  research  is  to  determine  whether  there  are  differences  in 
perceptions  between  AOs  and  CHs  regarding  internal  controls  within  the  GPCP  at 
NPS.  A  main  component  of  the  research  is  a  voluntary  and  anonymous  online 
survey  deployed  to  the  AOs  and  CHs  at  NPS.  Results  from  the  analysis  of  the 
survey  data  can  be  used  to  identify  areas  of  improvement  within  the  GPCP.  This 
research  also  potentially  identifies  any  implications  of  the  perceived  differences  of 
internal  controls  on  the  auditability  of  the  GPCP  at  NPS. 

C.  RESEARCH  QUESTIONS 

The  research  questions  for  this  research  are  as  follows: 

•  What  are  the  differences  in  perceptions  of  internal  controls  between 
the  approving  officials  and  cardholders  in  the  Government  Purchase 
Card  Program  at  the  Naval  Postgraduate  School? 

•  What  are  the  implications  to  auditability  from  the  differences  in 
perceptions  of  internal  control  between  approving  officials  and 
cardholders  within  the  Government  Purchase  Card  Program  at  the 
Naval  Postgraduate  School? 

D.  BENEFITS  AND  LIMITATIONS 

This  research  benefits  the  DoN,  and  more  specifically,  NPS,  by  analyzing  the 
AOs’  and  CHs’  perceptions  of  the  internal  controls  within  the  GPCP  at  NPS.  The 
results  of  the  analysis  are  used  to  identify  recommendations  to  strengthen  the 
internal  controls  within  the  GPCP  at  NPS.  In  addition,  this  research  potentially 
identifies  the  impact  that  those  differences  in  perceptions  of  internal  controls  have  on 
the  auditability  of  the  GPCP  at  NPS. 

The  limitations  of  this  research  include  the  limited  number  of  participants  who 
complete  the  voluntary  anonymous  online  survey.  Although  NPS  allowed  access  to 
all  of  its  AOs  and  CHs,  the  survey  was  voluntary,  so  not  all  potential  participants 
chose  to  participate.  Another  possible  limitation  is  the  survey  instrument  itself.  It  was 
a  combination  of  surveys  used  by  other  researchers,  but  it  may  have  been  limited  in 
the  type  of  questions  it  asked  with  regard  to  the  GPCP. 
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E. 


IMPORTANCE  OF  RESEARCH 


The  importance  of  this  research  is  that  the  GPCP  is  a  government-wide 
program  responsible  for  processing  hundreds  of  thousands  of  transactions  and 
accounting  for  billions  of  dollars  a  year.  To  ensure  the  program  is  managed  in 
accordance  with  policy  and  regulations,  it  is  imperative  to  understand  the  internal 
controls  within  the  GPCP.  This  research  assesses  the  perceptions  of  internal 
controls  by  both  AOs  and  CHs  and  makes  recommendations  to  the  GPCP  at  NPS. 

F.  METHODOLOGY 

This  research  includes  a  literature  review,  the  development  and  distribution  of 
the  online  survey,  and  an  analysis  of  the  responses  to  the  survey.  The  literature 
review  includes  a  review  of  scholarly  peer-reviewed  articles,  which  are  related  to 
internal  controls  and  purchase  cards.  Government  Accountability  Office  (GAO) 
reports,  government  policies,  and  DoD  and  DoN  instructions. 

The  online  survey  was  developed  using  a  previously  validated  internal  control 
survey  as  well  as  other  sources.  The  survey  consisted  of  demographic  survey  items 
and  Likert-based  survey  items  regarding  internal  controls.  The  survey  was  deployed 
to  AOs  and  CHs  at  NPS  using  the  web-based  survey  software,  LimeSurvey.  Once 
the  survey  was  deployed,  it  was  available  for  three  weeks. 

After  the  survey  period  was  over,  the  data  collected  from  the  survey 
responses  was  reviewed  and  analyzed  as  it  related  to  the  five  internal  control 
components.  Descriptive  statistics  was  used  in  the  data  analysis  using  SPSS. 

G.  SCOPE  AND  ORGANIZATION 

This  research  paper  contains  six  chapters,  including  the  introduction.  Chapter 
II  includes  a  literature  review  covering  the  industry  purchasing  card  and  the  GPCP 
and  its  application  to  the  federal  government,  the  DoD,  and  the  DoN.  The  chapter 
also  discusses  internal  controls  and  auditability,  including  supporting  legislation. 
Chapter  III  discusses  NPS’s  use  of  the  GPCP,  including  the  mission,  the  Contracting 
and  Logistics  Management  organization,  and  the  GPCP  organizational  structure. 
Chapter  IV  presents  the  methodology  used  to  conduct  the  research  and  to  develop 
and  deploy  the  online  survey.  Chapter  V  analyzes  the  survey  results,  discusses  the 
findings  and  the  implications  of  the  findings,  and  offers  recommendations  based  on 
the  findings.  Chapter  VI  summarizes  the  research  and  provides  conclusions  and 
areas  for  further  research.  The  following  section  provides  a  summary  of  this  chapter. 

H.  SUMMARY 

This  chapter  presented  the  background  and  purpose  of  this  research  and 
addressed  the  research  questions.  The  benefits  and  limitations,  in  addition  to  the 
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importance  of  this  research,  were  also  discussed.  Finally,  the  methodology  was 
briefly  outlined,  and  the  scope  and  organization  of  the  research  were  presented.  The 
next  chapter  provides  a  literature  review  of  the  purchase  card  program  and  internal 
controls. 
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II.  LITERATURE  REVIEW 


A.  INTRODUCTION 

This  chapter  presents  the  evolving  role  of  the  purchasing  function  and  the 
industry  purchase  card  program.  The  Government  Purchase  Card  Program  (GPCP) 
and  its  application  in  the  federal  government,  the  Department  of  Defense  (DoD),  and 
the  Department  of  the  Navy  (DoN)  are  then  discussed.  The  Naval  Postgraduate 
School  (NPS)  GPCP  is  discussed  in  Chapter  III.  In  addition,  corporate  governance  is 
addressed,  which  includes  auditability,  the  Sarbanes-Oxley  Act  of  2002  (SOX),  and 
Committee  of  Sponsoring  Organizations  of  the  Treadway  Commission  (COSO). 
Furthermore,  the  integrated  internal  control  components  are  discussed  as  well  as 
internal  controls  in  the  federal  government.  The  next  section  discusses  the  evolving 
role  of  the  purchasing  function. 

B.  THE  EVOLVING  ROLE  OF  THE  PURCHASING  FUNCTION 

In  most  organizations,  purchasing  is  a  basic  function  used  to  acquire  goods 
and  services  to  accomplish  the  goals  of  the  organization.  Purchasing  also 
contributes  to  the  success  of  the  organization  and,  in  some  cases,  has  more  impact 
on  the  bottom  line  than  other  business  functions  (Burt,  Dobler,  &  Starling,  2003). 
Throughout  the  history  of  purchasing,  many  changes  have  significantly  shifted 
supply  managers’  perspectives  of  the  purchasing  department  and  its  importance  to 
the  organization. 

Purchasing  has  long  been  considered  a  subordinate  function  to  research  and 
development,  finance,  marketing,  and  operations;  however,  it  has  developed  into  a 
strategic  management  function,  with  high  value  placed  upon  cost  savings  and 
increased  efficiency  and  effectiveness  (Burt  et  al.,  2003).  In  the  1960s  and  1970s, 
inventory  was  managed  with  a  manual  system,  and  the  focus  at  the  time  was  on 
purchase  price  and  preventing  production  line  shutdowns.  In  the  late  1970s, 
computers  began  to  help  with  inventory  management  at  the  same  time  that 
automation  in  the  production  process  was  increasing,  which  drove  unit  production 
costs  down.  In  the  1980s,  managers  began  to  manage  their  inventories  more 
carefully  and  started  to  utilize  computer-generated  materials  requirement  plans, 
which  in  turn  reduced  inventory  levels,  decreased  costs,  and  increased  efficiency. 
Finally,  in  the  late  1980s,  managers  included  supply  management  in  their 
organizations’  strategic  business  plans  and  increased  the  focus  on  purchasing 
departments  (Burt  et  al.,  2003).  The  historical  focus  was  purchase  price  as  well  as 
supply  continuity;  however,  today  the  focus  is  on  value-adding  benefits  such  as 
quality,  cost,  time,  technology,  and  supply  continuity. 
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Major  developments  in  the  purchasing  function  involve  the  area  of  supply 
management,  which  includes  cross-functional  teams,  supply  chains  and  networks, 
supply  alliances,  strategic  sourcing,  and  e-procurement.  Cross-functional  teams 
combine  members  of  different  functional  areas  to  find  solutions  to  problems, 
demonstrating  team  behavior  and  developing  leadership  skills  (Burt  et  al.,  2003). 
Cross-functional  team  participation  in  the  development  of  supply  chains  and 
networks  identifies  desirable  suppliers  by  identifying  which  value-added  activities  are 
most  important  to  the  organization’s  strategic  supply  plan  (Burt  et  al.,  2003).  Once 
the  supply  chains  and  networks  are  identified,  supply  alliances  are  fostered  through 
mutually  beneficial  relationships  (Burt  et  al.,  2003).  Furthermore,  supply 
management  personnel  must  decide  the  appropriate  relationship  with  each  supplier 
in  order  to  accomplish  organizational  goals  and  objectives. 

Management  has  also  shifted  its  thinking  about  using  sources  strategically. 
Strategic  sourcing  is  an  organized  approach  that  utilizes  the  supply  base  to  achieve 
the  organization’s  objectives.  Strategic  sourcing  also  integrates  suppliers  into  long¬ 
term  plans  and  improves  the  organization’s  value.  Lastly,  Burt  et  al.  (2003)  stated 
that  “e-procurement  is  one  of  the  most  exciting  developments  in  supply 
management”  (p.  33).  Technologies  that  enhance  business  operations  have 
emerged.  Buyers  are  no  longer  required  to  process  paperwork  since  they  can  now 
place  orders  over  the  Internet  directly  to  suppliers.  This  is  a  major  development  for 
the  purchasing  department,  and  the  use  of  technology  supports  streamlining  and 
strategic  sourcing  initiatives. 

Leenders  and  Fearon  (1997)  discussed  the  advantages  of  both  a  centralized 
and  decentralized  purchasing  department.  The  advantages  of  centralization  include 
a  standardized  purchasing  process  and  decreased  administrative  duplication. 
Therefore,  that  results  in  an  increase  in  the  number  of  contracts  for  large  quantities 
of  items  for  the  organization.  However,  decentralizing  the  purchasing  authority 
allows  independent  department  managers  to  handle  their  own  purchasing  since  they 
are  more  familiar  with  the  department’s  specific  requirements  (Leenders  &  Fearon, 
1997).  Decentralized  authority  also  gives  the  purchaser  more  flexibility,  which 
necessitates  an  additional  emphasis  on  internal  controls  to  help  ensure  that 
purchasers  are  in  compliance  with  established  purchasing  policies  and  procedures. 
While  these  developments  are  helping  streamline  purchasing  initiatives,  there 
appears  to  be  a  small-order  problem,  which  is  discussed  in  the  next  section. 


1.  Small-Order  Problem 

Leenders  and  Fearon  (1997)  and  Burt,  Petcavage,  and  Pinkerton  (2010) 
discovered  that  small  orders  are  a  problem  in  most  organizations.  Burt  et  al.  (2010) 
gave  an  example  of  a  typical  company  in  which  a  large  percentage  (sometimes  as 
high  as  80%)  of  its  purchases  involved  a  purchase  of  less  than  $250.  However, 
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these  purchases  represented  a  small  percentage  (close  to  10%)  of  the 
organization’s  total  annual  spending.  With  the  current  purchasing  department 
organization,  the  transaction  cost  to  purchase  a  small-value  item  is  likely  more  than 
the  item  cost  itself  (Monczka,  Hanfield,  Giunipero,  &  Patterson,  2011).  Thus,  the 
organization  is  spending  more  time  and  money  on  small  purchase  transactions. 
Leenders  and  Fearon  (1997)  offered  approaches  to  simplify  or  automate  the 
purchasing  process,  reduce  cycle  time,  lower  costs,  and  increase  the  buyers’  time 
spent  on  high-value  orders.  One  solution  to  the  small-order  problem  was  the  use  of 
purchase  cards  distributed  to  internal  customers  to  order  directly  from  suppliers, 
which  was  one  of  the  new  streamline  initiatives  supported  by  e-procurement.  The 
process  of  moving  the  small-value  purchasing  activity  to  the  department’s  cardholder 
reduces  cycle  time  and  transaction  costs  (Burt  et  al.,  2003).  In  addition,  the  transition 
of  small-value  purchasing  allows  the  purchasing  agents  to  concentrate  their  time  on 
higher  value  purchases  (Leenders  &  Fearon,  1997).  Therefore,  a  tool  most 
organizations  considered  central  to  improving  the  purchasing  process  was  the 
purchase  card  (Monczka  et  al.,  201 1 ). 

The  use  of  purchase  cards  and  the  implementation  of  the  purchase  card 
program  is  a  solution  to  the  small-order  problem.  The  purchase  card  is  used  to  pay 
for  items  of  small  value,  including  maintenance,  repair,  and  operating  (MRO)  items. 
MRO  items  do  not  become  part  of  an  organization’s  product,  but  they  are  essential 
for  operating  the  business.  This  includes  “spare  machine  parts,  office  and  computer 
supplies,  and  cleaning  supplies”  (Monczka  et  al.,  2011,  p.  74).  Some  organizations 
set  a  purchase  threshold  limit  that  cardholders  cannot  exceed  when  purchasing 
MRO  items.  The  National  Association  of  Purchasing  Card  Professionals  (NAPCP; 
2013a)  website  states  that  “P-Cards  were  introduced  as,  and  continue  to  be, 
corporate  (organization)  liability/central  pay  payment  vehicles  for  which  payment  in 
full  must  be  made  by  the  end  user  organization  to  the  card  issuer  at  least  monthly” 
(para.  3).  This  attribute  of  a  P-Card  remains  the  primary  distinction  from  consumer 
and  small  business  credit  cards. 

Other  commercial  card  products  include  the  travel  card,  corporate  card,  fleet 
card,  one  card,  prepaid  card,  declining  balance  card,  and  business  card  (NAPCP, 
2013d).  They  are  all  intended  to  address  different  types  of  purchases;  however,  this 
research  focuses  on  the  P-Card,  as  it  is  most  similar  to  the  purchase  card  used  in 
the  GPCP. 

This  section  discussed  the  evolving  role  of  the  purchasing  function  and  the 
small-order  problem.  In  addition,  it  showed  how  the  purchase  card  is  a  solution  to 
that  problem.  The  next  section  includes  a  discussion  of  the  use  of  the  P-Card  in 
industry. 
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c. 


INDUSTRY  P-CARD  PROGRAM 


The  industry  purchase  card,  also  known  as  a  P-Card,  is  a  credit  card  that 
allows  end-user  organizations  to  utilize  the  existing  credit  card  infrastructure  to  make 
business-to-business  payments  for  a  variety  of  business  expenses,  such  as  goods 
and  services  (NAPCP,  2013c,  para.  1).  After  the  purchase  card  was  developed  and 
introduced  to  the  U.S.  federal  government  for  the  General  Services  Administration 
(GSA),  the  P-Card  was  introduced  to  industry  in  the  1980s.  The  P-Card  is  most 
commonly  used  in  the  corporate,  education,  and  government  sectors.  The  P-Card  is 
similar  to  a  consumer  credit  card;  however,  the  end-user  organization  using  a  P- 
Card  must  pay  the  card-issuing  bank  the  full  balance  on  a  monthly  basis,  instead  of 
monthly  minimum  payments  until  the  credit  card  bill  is  paid  off.  For  low-value 
purchases,  which  are  considered  less  than  $2,500,  respondents  of  a  2010  survey 
reported  that  purchase  cards  now  handle  44%  of  all  transactions  (Palmer  &  Gupta, 
2010).  In  2009,  large  market  industry  organizations  had  449  P-Cards  and  made 
approximately  8.6  monthly  transactions  per  card,  and  spent  a  monthly  average  of 
$1.03  billion  (Palmer  &  Gupta,  2010).  Large  market  statistics  include  companies  with 
annual  sales  of  $500  million  to  $2  billion  (Palmer  &  Gupta,  2010). 

The  P-Card  program  in  industry  was  developed  to  streamline  payment  and 
reduce  costs  for  purchasing  small-value  items,  which  helps  solve  the  small-order 
problem  that  was  previously  discussed.  The  P-Card  program  is  a  valuable  asset  to 
most  organizations.  The  P-Card  program  involves  the  use  of  a  credit  card  that  allows 
an  organization’s  employees,  also  known  as  a  cardholder,  to  make  small-value 
purchases  in  a  timely  and  efficient  manner.  The  P-Card  program  also  expedites 
supplier  payments  and  reduces  or  eliminates  the  paperwork  associated  with  a  paper 
transaction  (Gupta  &  Palmer,  2008).  P-Cards  have  proven  their  value  in  improving 
efficiencies,  decreasing  processing  costs,  and  decreasing  cycle  time  (Palmer  & 
Gupta,  2010).  Transaction  costs  have  decreased  by  76%,  and  cycle  time  was 
reduced  by  72%  (Palmer  &  Gupta,  2010).  The  future  goals  of  the  P-Card  include 
such  things  as  increasing  convenience  and  reducing  transaction  processing  (Palmer 
&  Gupta,  2010). 

The  industry  P-Card  program  also  has  the  option  to  implement  internal 
controls,  including  single-purchase  spending  limits,  monthly  limits,  and  other 
restrictions  (NAPCP,  2013b).  Internal  controls  are  discussed  later  in  this  chapter, 
and  other  sections  discuss  the  application  of  a  purchase  card  program  in  multiple 
settings,  to  include  the  federal  government,  the  DoD,  and  the  DoN.  The  next  section 
provides  an  overview  of  the  roles  and  responsibilities  within  an  industry  P-Card 
program. 
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1.  Roles  and  Responsibilities  Within  an  Industry  P-Card  Program 

This  section  provides  an  overview  of  the  roles  and  responsibilities  of  the 
entities  involved  in  a  P-Card  program.  Those  roles  include  cardholders,  end-user 
organizations,  issuers,  merchant  acquirers,  networks,  and  processors. 

Cardholders  are  responsible  for  making  purchases  and  payments  on  behalf  of 
the  end-user  organization.  Cardholders  are  expected  to  follow  the  end-user 
organization’s  specific  policies  and  are  responsible  for  reviewing  and  approving 
transactions  at  least  monthly  (NAPCP,  2013b).  End-user  organizations  receive  the 
invoices  from  cardholders’  P-Card  transactions  and  are  responsible  for  paying  the 
balance  in  full  monthly.  The  end-user  organization  assumes  liability  for  payment 
(NAPCP,  2013b).  Issuers  work  directly  with  the  end-user  organizations  to  issue  P- 
Cards  and  invoice  P-Card  transactions.  According  to  NAPCP  (2013b),  issuers  are 
often  financial  institutions,  and  they  work  with  networks  and  processors  to  issue 
cards,  authorize  transactions,  and  provide  data. 

According  to  the  NAPCP  (2013b),  merchant  acquirers  “enroll  suppliers  in  the 
card  acceptance  process  and  implement  required  solutions  related  to  this  purpose. 

In  addition,  they  facilitate  payment  flow,  including  payment  to  suppliers,”  (para.  3). 
Networks  facilitate  the  movement  of  transactional  data  between  the  issuer  and 
merchant  acquirer  and  set  the  rules  pertaining  to  P-Card  acceptance  by  suppliers 
(NAPCP,  2013b,  para.  4).  Examples  of  networks  include  Visa,  MasterCard,  and 
American  Express.  Processors  “provide  various  services  to  card  issuers  and 
merchant  acquirers,  which  may  include  card  production,  statement  printing, 
authorization,  and  data  delivery”  (NAPCP,  2013b,  para.  5). 

It  is  important  to  know  the  roles  and  responsibilities  previously  described  to 
understand  the  interrelationships  between  cardholders,  end-user  organization, 
issuers,  merchant  acquirers,  networks,  and  processors.  Each  participant  plays  a 
significant  role  in  the  success  of  a  P-Card  program.  The  P-Card  process  and  the 
relationship  between  all  of  the  entities  involved  are  illustrated  in  Appendix  A.  This 
section  discussed  the  use  of  the  P-Card  in  an  industry  P-Card  program  and  provided 
an  overview  of  the  roles  and  responsibilities  within  an  industry  P-Card  program.  Just 
like  in  industry,  the  federal  government  also  has  a  purchase  card  program.  The  next 
section  reviews  the  GPCP. 

D.  GOVERNMENT  PURCHASE  CARD  PROGRAM 

The  government’s  interest  in  purchase  cards  began  in  1982  as  a  procurement 
initiative  reform  (Gupta  &  Palmer,  2008).  After  the  successful  pilot  phase  in  1986, 
the  government  began  utilizing  the  purchase  card  program  in  1989  when  the  first 
government-wide  purchase  card  contract  was  awarded  by  the  GSA  to  the  Rocky 
Mountain  BankCard  System.  In  1993,  the  United  States’  Vice  President’s  National 
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Performance  Review  further  streamlined  the  purchase  card  process  and  reduced  the 
red  tape  to  make  a  purchase  under  the  micro-threshold  of  $2,500.  In  October  1994, 
the  Federal  Acquisition  Streamlining  Act  (FASA)  of  1994  and  Executive  Order 
12,931  (1994)  were  established  to  further  promote  the  use  of  the  purchase  card.  In 
2002,  when  the  purchase  card  program  was  at  risk  because  of  the  General 
Accounting  Office  (GAO,  2003)  and  Inspectors  General  report  findings  of  misuse, 
agencies  were  told  to  review  their  internal  controls  associated  with  minimizing  risk  in 
the  purchase  card  program  (Gupta  &  Palmer,  2008).  In  2006,  the  micro-purchase 
threshold  was  increased  from  the  previous  $2,500  to  the  current  threshold  of  $3,000. 
The  government  is  continuously  striving  to  improve  the  various  aspects  of  the 
GPCP,  including  internal  controls. 

Prior  to  the  use  of  purchase  cards,  the  government  used  the  traditional  paper- 
based  procurement  process,  such  as  purchase  orders,  to  place  orders;  however, 
that  method  offered  little  flexibility  and  no  accountability  or  oversight,  nor  did  it  solve 
the  small  order  problem.  Thus,  one  of  the  major  benefits  of  using  purchase  cards  is 
that  it  helped  solve  the  small-order  problem.  Another  benefit  of  using  the  purchase 
card  is  the  “ability  to  streamline  transaction  processing,  increase  accountability,  and 
provide  agencies  with  a  more  efficient  and  effective  means  of  monitoring  large 
numbers  of  transactions,  and  identifying  fraud,  waste,  and  abuse  in  the  program” 
(GSA,  n.d.-a).  The  Office  of  Inspector  General  (OIG;  2014)  defines  fraud,  waste  and 
abuse  on  its  website.  Fraud  is  “a  type  of  illegal  act  involving  the  obtaining  of 
something  of  value  through  willful  misrepresentation.  Waste  relates  primarily  to 
mismanagement,  inappropriate  actions,  and  inadequate  oversight.  Abuse  involves 
behavior  that  is  deficient  or  improper  as  well  as  misuse  of  authority  or  position  for 
financial  interests,”  (OIG,  2014,  paras.  2,  5,  6).  The  various  government  actions 
enabling  the  government-wide  purchase  card  program  over  the  years  are  shown  in 
Table  1 . 
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Table  1.  Government  Actions  Related  to  the  Purchase  Card  Program 

(Adapted  from  Gupta  &  Palmer,  2008,  p.  177) 


Government  Actions 

Year 

Executive  Order  12352 

1982 

Pilot  Phase  of  a  Government  Commercial  Credit  Card 

1986 

Introduction  of  Government-Wide  Purchase  Card  System 

1989 

National  Performance  Review  (NPR)  Recommendations 

1993 

Federal  Acquisition  Regulation  (FAR)  Interim  Rule 

1994 

Federal  Acquisition  Streamlining  Act  (FASA) 

1994 

Executive  Order  12931 

1994 

Introduction  of  SmartPay 

1998 

Office  of  Management  and  Budget  Memo 

2002 

Proposed  Legislation 

2005 

Revised  0MB  Circular  A-1 23 

2006 

0MB  Circular  A-123,  Revised  Appendix  B 

2009 

The  GPCP  implements  streamlining  initiatives  and  offers  a  solution  to  the 
small-order  problem,  which  is  discussed  later.  The  federal  government  application  of 
the  GPCP  is  discussed  next. 

1.  Federal  Government  Application  of  the  Government  Purchase 
Card  Program 

The  GPCP,  now  known  as  the  GSA  SmartPay  Program,  partnered  with 
national  banks  to  provide  purchase  cards  to  over  52  federal  agencies/departments 
and  non-independently  reported  agencies  throughout  the  government  to  support 
streamlined  acquisition  initiatives.  The  GPCP  is  intended  to  “streamline  the  small 
purchase  and  the  payment  process,  minimize  paperwork,  eliminate  imprest  fund 
transactions,  and  generally  simplify  the  administrative  effort  associated  with 
procuring  goods  and  services  under  the  micro-purchase  threshold”  (“Government 
Purchase  Card  [GPC]  Program,”  2013,  para.  1).  According  to  the  Federal  Acquisition 
Regulation  (FAR)  2.101  (2014),  a  micro-purchase  is  an  acquisition  of  supplies  or 
services  using  simplified  acquisition  procedures,  where  the  total  amount  of  the 
purchase  does  not  exceed  the  micro-purchase  threshold,  which  is  currently  set  at 
$3,000. 

The  following  sections  discuss  the  small-order  problem  and  the  use  of  the 
purchase  card  in  the  federal  government.  In  addition,  an  overview  of  the  roles  and 
responsibilities  and  the  training  requirements  are  discussed  regarding  the  federal 
government  GPCP. 
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a.  Small-Order  Problem  as  Related  to  the  Federal  Government 

Purchase  Card  Program 

The  implementation  of  the  purchase  card  program  is  beneficial  to  the 
government  because  it  increases  savings  and  decreases  costs  and  transaction 
times  associated  with  small  orders.  Once  the  purchase  card  is  in  the  hands  of 
customers,  they  can  streamline  purchasing  and  eliminate  the  use  of  purchasing 
agents,  which  helps  lower  the  transaction  costs  of  items.  Involving  a  purchasing 
agent  in  a  lower  value  purchase  would  likely  outweigh  the  cost  of  the  item,  thereby 
emphasizing  the  value  of  the  purchase  card  (Monczka  et  al.,  201 1 ).  Palmer  et  al. 
(2010)  determined  from  their  research  that,  “The  best  estimate  of  government  cost 
savings  from  driving  a  paper-based  approval  and  payment  process  to  a  purchase 
card  is  $69  per  transaction”  (p.  324).  The  government  will  realize  more  cost  savings 
as  more  transactions  are  being  paid  for  by  the  purchase  card  (Palmer  et  al.,  2010). 
Gupta  and  Palmer  (2008)  found  that  purchases  under  the  micro-purchase  threshold 
accounted  for  only  2%  of  total  federal  government  spending,  but  85%  of  all 
procurement  transactions.  That  is  a  significant  majority  of  the  purchasing 
requirements.  This  finding  reinforced  the  fact  that  the  small-order  problem  is 
prevalent  in  the  federal  GPCP  and  illustrated  the  importance  of  the  purchase  card. 
The  next  section  discusses  the  use  of  the  purchase  card  in  the  federal  government 
and  metrics  in  the  current  fiscal  environment. 


b.  Purchase  Card  Use  In  the  Federal  Government 

The  federal  government  has  recognized  the  benefit  of  the  purchase 
card  since  the  initial  legislation  that  introduced  it  in  1982  (Palmer  et  al.,  2010).  Since 
the  inception  of  the  program,  the  pressure  to  utilize  the  purchase  card  increased, 
enabling  the  program  to  grow,  until  recently.  Since  2000,  the  government  purchase 
card  has  “accounted  for  65  to  70  percent  of  commercial  card  spending”  (Palmer  et 
al.,  2010,  p.  317).  The  federal  government  uses  the  term  commercial  card  to  refer  to 
the  travel,  fleet,  and  purchase  cards.  For  example,  in  2008,  the  government  spent 
$30.6  billion  on  the  commercial  card,  $19.8  billion  of  which  was  spent  on  the 
purchase  card  (Palmer  et  al.,  2010).  However,  researchers  agreed  that  the 
program’s  growth  has  slowed  because  of  maturation  and  is  now  on  a  slow  decline 
(Gupta  &  Palmer,  2008;  Palmer  et  al.,  2010).  That  is  not  surprising  because  of  the 
current  fiscal  environment. 

In  their  study  on  purchase  card  use.  Palmer  et  al.  (2010)  compared  the 
number  of  cards,  transactions,  and  total  spending  over  six  fiscal  years,  from  2008  to 
2013.  The  number  of  cardholders  was  close  to  357,000  in  2008  (Palmer  et  al., 

2010),  compared  to  300,900  in  2013  (GSA,  n.d.-c).  This  decrease  in  cardholders  is 
in  keeping  with  several  government  reports  that  encourage  lowering  the  number  of 
cardholders  to  gain  more  control  over  the  program  and  reduce  fraud,  waste,  and 
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abuse  (GAO,  2008).  The  number  of  transactions  has  been  in  a  steady  decline,  from 
25.5  million  in  2008  (Palmer  et  al.,  2010)  to  18.9  million  in  2013  (GSA,  n.d.-c).  It 
appears  as  though  the  government  may  not  be  utilizing  the  program  to  its  full 
potential,  and  therefore  may  not  be  realizing  the  total  benefits.  In  addition,  the  total 
purchase  card  spending  was  at  a  high  of  $19.8  billion  in  2008  (Palmer  et  al.,  2010) 
and  was  at  a  low  of  $16.5  billion  in  2013  (GSA,  n.d.-c).  This  decrease  may  be  due  to 
the  major  budget  cuts  in  the  federal  government.  The  purchase  card  program  has 
been  very  beneficial  to  the  government  by  moving  the  purchasing  authority  to  the 
customer,  reducing  transaction  time,  and  increasing  cost  savings.  The  next  section 
includes  a  discussion  of  the  roles  and  responsibilities  within  the  federal  GPCP. 

c.  Roles  and  Responsibilities  Within  the  Federal  Government 

Purchase  Card  Program 

The  participants  of  the  federal  GPCP  include  the  agency/organization 
program  coordinator  (A/OPC),  approving  official  (AO),  cardholder  (CH),  designated 
billing  office  (DBO),  merchant,  and  card-issuing  bank.  The  purchase  card  may  only 
be  issued  to  civilian  or  military  personnel,  so  contractors  cannot  participate  in  the 
program.  The  A/OPC  is  responsible  for  managing  and  overseeing  the  command’s 
GPCP,  establishing  internal  guidelines,  establishing  and  maintaining  accounts,  and 
assisting  cardholders.  The  AO  is  the  first  point  of  contact  to  prevent  fraud,  waste, 
and/or  abuse  of  the  purchase  card.  The  AO  supervises  the  CH  and  is  responsible  for 
reviewing  and  approving  his  or  her  purchases.  The  AO  should  also  resolve  any 
questionable  purchases  and  report  any  misconduct.  The  CH  uses  the  government 
purchase  card  to  acquire  supplies  and  services  within  the  CH’s  authority.  The  CH  is 
responsible  for  using  the  card  properly  and  ethically  and  following  all  rules  and 
regulations  associated  with  the  CH’s  delegated  purchase  authority.  The  DBO 
oversees  invoice  processing  and  payment.  The  card-issuing  bank  is  responsible  for 
issuing  purchase  cards,  processing  merchant  charges  and  credits,  and  providing 
monthly  AO  and  CH  account  statements  (GSA,  n.d.-d).  The  government  has 
partnerships  with  Citibank,  JP  Morgan  Chase,  and  U.S.  Bank  (GSA,  n.d.-b),  and 
these  institutions  serve  as  the  issuing  banks  for  government  agencies.  The  following 
section  discusses  the  training  requirements  within  the  federal  GPCP. 


d.  Training  Requirements  Within  the  Federal  Government 
Purchase  Card  Program 

The  Office  of  Management  and  Budget  (0MB,  2009)  Circular  A-123, 
Appendix  B,  requires  each  agency  to  provide  training  to  CHs  and  card  managers 
(including  A/OPCs  and  AOs).  At  a  minimum,  the  General  Services  Administration 
(GSA)  requires  online  training  and  refresher  training  offered  by  the  Defense 
Acquisition  University  (DAU).  Credit  worthiness  assessments  used  to  be  mandated 
for  new  CHs,  but  after  the  passing  of  the  2006  Consolidated  Appropriations  Act,  that 
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requirement  was  eliminated  (Defense  Procurement  and  Acquisition  Policy  [DPAP], 
201 1 ;  Rendon,  201 1 ).  The  GSA  SmartPay  Program  offers  free  online  CH  training  to 
all  program  participants.  The  program  requires  participants  to  complete  training  prior 
to  appointment  to  any  position  within  the  GPCP.  In  addition,  refresher  training  is 
required  once  every  three  years  or  more  often  based  on  agency  requirements. 
Finally,  ethics  training  is  also  required.  Program  participants  should  remain  familiar 
with  the  rules  and  regulations  governing  the  use  of  the  purchase  card  (GSA,  n.d-c). 
AOs  should  also  familiarize  themselves  with  their  agency’s  approval  and  tracking 
systems. 

As  previously  mentioned,  the  GSA  SmartPay  contract  provides 
purchase  cards  to  over  52  federal  agencies,  one  of  which  is  the  DoD.  The  DoD 
application  of  the  GPCP  is  discussed  in  the  next  section. 

2.  Department  of  Defense  Application  of  the  Government  Purchase 

Card  Program 

The  DoD  GPCP  currently  uses  Citibank  to  process  all  types  of  transactions, 
including  those  made  with  the  purchase,  travel,  and  fleet  card.  However,  the  DoD’s 
independent  agencies  also  use  U.S.  Bank  solely  for  purchase  card  transactions.  In 
FY2008,  the  DoD  GPCP  had  98,839  cardholders,  making  8.8  million  transactions 
totaling  $7.9  billion.  As  of  FY2013,  the  GSA  SmartPay  Program  reported  that  the 
DoD  purchase  card  program  had  approximately  92,647  cardholders  making  5.7 
million  transactions  valued  around  $4.9  billion.  (GSA,  n.d.-c)  The  DoD  GPCP  has 
significantly  downsized  in  the  last  five  years,  which  is  expected  in  the  current  fiscal 
environment.  However,  the  DoD  embraces  the  purchase  card  program  as  it 
continually  seeks  methods  for  cost  savings  and  increased  accountability.  The  next 
section  discusses  the  DoD  guidance  for  the  GPCP. 

a.  Department  of  Defense  Guidance  for  the  Government 

Purchase  Card  Program 

FAR  13.301  (2014)  and  Defense  Federal  Acquisition  Regulation 
Supplement  (DFARS)  213.270  (2014)  and  213.301  (2014)  outline  the  policy  for 
using  the  GPCP.  The  DoD  also  provides  guidance  for  its  components  to  help 
establish  the  purchase  card  program  and  implement  government-  and  DoD- 
mandated  controls,  rules,  and  regulations.  The  DoD  Purchase  Card  Program 
Management  Office  has  oversight  of  the  DoD’s  GPCP  (Office  of  Financial 
Management  [FMO],  n.  d.).  Each  component  may  adopt  more  stringent  controls  if 
necessary  or  desired,  but  the  rules  and  regulations  apply  to  every  component 
utilizing  the  GPCP.  The  process  of  establishing  a  purchase  card  program  entails 
determining  a  need,  requesting  authority,  establishing  internal  controls,  and 
establishing  training  programs  for  program  officials  (DPAP,  2011).  The  purpose  of 
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the  purchase  card  is  to  add  value  to  the  business  processes  in  terms  of  lower  costs 
or  increased  productivity,  but  the  mandatory  outcome  is  ensuring  that  “management 
controls  effectively  identify,  correct,  and  minimize  fraud,  waste,  and  abuse”  (DPAP, 

2011,  p.  2-2). 

To  minimize  risks,  the  management  and  internal  controls  should  have 
support  from  higher  levels,  expect  integrity  and  ethical  behavior  from  participants, 
engage  in  audits  annually,  ensure  controls  are  working  properly,  and  provide  proper 
training,  both  initial  and  refresher  (DPAP,  2011).  Following  the  guidelines  for 
maintaining  those  controls  will  ensure  that  each  component’s  program  has  strong 
internal  controls,  capable  processes,  and  properly  trained  personnel  (Rendon  & 
Rendon,  2014). 

One  of  the  management  controls  in  place  is  the  Purchase  Card  Online 
System.  It  is  a  DoD-wide  system  used  by  GPCP  users  to  improve  the  management 
and  accountability  within  each  component’s  GPCP  organization  (DPAP,  2011). 
Additionally,  the  DoD  has  many  resources  that  require  management’s  compliance 
with  specific  rules  and  regulations  regarding  processes,  internal  controls,  and 
training.  The  next  section  discusses  the  accountability  methods  within  the  DoD 
GPCP. 


b.  Department  of  Defense  Accountability  Methods  Within  the 
Government  Purchase  Card  Program 

Adequately  trained  program  personnel  are  vital  to  maintaining 
accountability.  The  roles  and  responsibilities  previously  outlined  in  the  federal  GPCP 
section  are  applied  to  the  DoD  as  well  as  to  the  DoN  and  NPS.  An  AC  may  not 
oversee  more  than  seven  CHs,  and  an  A/CPC  may  not  be  responsible  for  more  than 
300  accounts  (DPAP,  201 1 ).  An  individual  CH  or  AC  may  be  responsible  for  more 
than  one  account.  All  participants  involved  in  a  purchase  card  program  must  receive 
training  mandated  by  the  GSA  SmartPay  Program.  The  DoD-mandated  purchase 
card  course  is  titled  “DoD  Government  Purchase  Card  Tutorial”  and  is  hosted  by  the 
DAU  (DPAP,  201 1 ).  The  DAU  offers  two  online  courses,  one  to  study  the  training 
material  and  the  other  for  refresher  training.  Each  program  participant  must  produce 
a  certificate  of  completion  to  the  APC  after  taking  the  online  test. 

Now  that  the  DoD  application  of  the  purchase  card  has  been  covered, 
the  next  section  reviews  the  purchase  card  program  application  of  one  of  the  DoD’s 
components,  the  DoN. 


3.  Department  of  the  Navy  Application  of  the  Government  Purchase 
Card  Program 

The  DoN  GPCP  services  are  provided  by  a  task  order  issued  under  the  main 
GSA  SmartPay2  contract,  which  expires  November  2018  (Naval  Supply  Systems 
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Command  [NAVSUP],  2012).  The  DoN  instruction  applies  policy  guidance  from  10 
U.S.C.  §  2784  (2014);  0MB  (2009)  Circular  A-1 23,  Appendix  B;  and  the  DoD 
government  charge  card  guidebook  (DPAP,  2011).  These  policies  discuss  the 
management  of  a  purchase  card  program,  internal  controls  needed  to  manage  the 
program,  and  penalties  for  violations  of  the  GPCP  policies. 

The  DoN  Consolidated  Card  Program  Management  Division  (CCPMD)  serves 
as  the  DoN  Component  program  manager,  which  is  organizationally  aligned  within 
the  NAVSUP  Corporate  Operations  division  (FMO,  n.d.).  In  2012,  NAVSUP 
disseminated  an  instruction  guide  to  help  establish  DoN  policy  for  management  of 
the  GPCP.  In  FY2001,  the  Navy  had  the  “second  largest  purchase  program  in  the 
DoD,  with  approximately  27,900  cardholders  making  2.8  million  transactions  valued 
at  $1.8  billion”  {Purchase  Cards,  2002,  p.  1;  GSA,  n.d.-c).  Twelve  years  later,  in 
FY2013,  the  program  had  10,200  cardholder  accounts,  made  130,000  transactions, 
and  spent  $128.57  million  in  purchases  (NAVSUP,  2013).  Like  the  DoD  program,  the 
DoN  program  has  also  decreased  in  size,  which  is  not  unusual  given  the  current 
fiscal  environment.  Therefore,  with  this  current  fiscal  environment,  it  is  crucial  to  use 
the  program  efficiently  and  effectively.  The  NAVSUP  (2012)  Instruction  4200.99B 
outlines  roles  and  responsibilities,  program  management,  use  of  the  purchase  card, 
program  oversight,  and  disciplinary  actions  associated  with  the  DoN’s  application  of 
the  GPCP,  which  is  discussed  next. 

a.  Department  of  the  Navy  Roles  and  Responsibilities/Training 

All  roles  and  responsibilities  are  similar  to  those  given  for  both  federal 
government  and  DoD  programs  to  include  A/OPC,  AO,  CFI,  disbursing  paying  office, 
and  card-issuing  bank,  among  others  not  mentioned.  The  one  addition  is  that  the 
A/OPC  also  serves  as  a  liaison  to  the  DoN  CCPMD.  In  accordance  with  NAVSUP 
(2012)  Instruction  4200. 99B,  all  CFIs  and  AOs  must  receive  purchase  card  training 
and  ethics  training.  The  courses  are  role-  and  certification  system-specific. 
Furthermore,  the  DoN  requires  that  its  program  participants  take  purchase  card 
refresher  training  every  two  years,  which  is  more  stringent  than  the  GSA  SmartPay 
Program  requirement  of  every  three  years,  and  annual  DoD  ethics  training.  The  DoN 
CCPMD  sponsored  regional  training  is  one  way  for  program  participants  to  complete 
the  purchase  card  refresher  training  (NAVSUP,  2013).  Training  is  “key  to  ensuring 
that  the  workforce  has  the  skills  necessary  to  achieve  organizational  goals” 
{Purchase  Cards,  2002,  p.  7).  The  next  section  discusses  the  DoN  GPCP 
management. 
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b.  Department  of  the  Navy  Government  Purchase  Card 
Program  Management 

The  DoN  GPCP  management  is  comprised  of  personnel  requirements, 
separation  of  duties,  span  of  control,  training  requirements,  and  other  account 
information,  which  are  reflective  of  the  guidance  given  for  the  DoD  and  federal 
government  programs.  Purchase  card  program  personnel  must  be  civilian 
government  employees  or  members  of  the  armed  forces,  with  exceptions  given  to 
some  specific  positions.  Separation  of  duties  aims  to  limit  the  cross  interaction  of 
AOs,  CHs,  and  A/OPCs  in  the  same  hierarchy.  Training  requirements,  including 
initial,  refresher,  and  ethics,  were  previously  discussed.  Once  the  training  is 
completed  and  documented,  the  participant  receives  authority  in  a  letter  of 
delegation  with  the  approved  spending  limit  for  the  position  in  which  the  CH  was 
trained  (NAVSUP,  2012).  Next,  the  DoN  use  of  the  government  purchase  card  is 
discussed. 


c.  Department  of  the  Navy  Use  of  the  Government  Purchase 

Card 

As  previously  mentioned,  the  purchase  cards’  authorized  use  is  for 
paying  for  micro-purchases  ($3,000  limit)  of  supplies,  services,  or  construction  for 
government  use  to  meet  the  government  organizations’  mission.  The  purchase  card 
is  to  be  used  only  for  authorized  and  approved  purchases,  not  for  personal  use 
purchases.  In  addition,  statutory  requirements  must  be  met  in  order  to  use  the 
purchase  card  as  a  form  of  payment.  A  CH  must  have  the  authority  to  purchase 
goods  and  services  and  must  follow  DoD  and  DoN  purchasing  regulations.  Finally, 
program  participants  must  be  in  compliance  with  purchasing  internal  controls  when 
purchasing  for  the  command  (NAVSUP,  2012). 

d.  Department  of  the  Navy  Government  Purchase  Card 

Program  Oversight 

Program  oversight  is  “required  to  ensure  effectiveness  of  purchasing 
and  management  internal  controls  and  includes  monthly,  quarterly,  and  semiannual 
reviews”  (NAVSUP,  2012,  p.  46).  This  includes  assurances  from  both  CHs  and  AOs 
regarding  transaction  reviews  and  account  reconciliations.  There  are  procedures 
that  need  to  be  followed  in  order  to  correctly  and  thoroughly  conduct  account  and 
program  oversight. 

This  section  discussed  the  DoN  application  of  the  GPCP,  including 
roles  and  responsibilities,  program  management,  use  of  the  purchase  card,  and  the 
DoN  GPCP  oversight.  As  previously  mentioned,  the  NPS  GPCP  is  discussed  in 
Chapter  III.  In  order  for  the  GPCP  to  be  successful,  there  must  be  sufficient 
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corporate  governance,  including  auditability  and  adherence  to  legislature  and  current 
practices,  which  is  discussed  next. 

E.  CORPORATE  GOVERNANCE 

This  section  of  the  literature  review  provides  an  overview  of  auditability, 
legislature,  and  current  practices,  to  include  the  SOX  and  the  COSO.  This  section  is 
the  foundation  to  understand  the  internal  controls  governing  purchase  card 
programs. 

1.  Auditability 

Auditability  is  a  high-level  priority  for  the  DoD  because  it  demonstrates 
responsible  stewardship  of  taxpayers’  money,  reduces  costs  of  business  operations, 
and  complies  with  congressional  direction  (Murphy-Sweet,  2013).  The  government  is 
striving  to  achieve  auditability  by  September  30,  2017,  which  is  the  deadline  outlined 
in  the  National  Defense  Authorization  Act  (NDAA)  for  FY2010.  To  receive  a  clean 
audit  and  reach  financial  auditability  by  2017,  the  DoD  and  DoN  implemented  an 
audit  readiness  initiative.  The  DoN’s  audit  readiness  strategy  focuses  on 

evaluating  business  processes  to  ensure  the  design  and  operation 
effectiveness  of  their  internal  controls  comply  with  federal  financial 
standards;  correcting  identified  internal  control  deficiencies;  ensuring 
that  internal  controls  remain  effective  through  continuous  monitoring, 
testing,  and  auditing;  and  retaining  key  supporting  documentation 
demonstrating  proper  execution  of  business  processes  for  inspection 
at  all  levels.  (Patton,  2013,  p.  23) 

As  reflected  in  this  initiative,  the  DoN’s  audit  readiness  strategy  is  to  focus  on 
internal  controls.  Financial  Improvement  and  Audit  Readiness  (FIAR)  “supports  the 
DoN’s  audit  readiness  initiative,  with  the  long-term  goal  of  improving  financial 
processes  and  systems  throughout  the  Navy,”  (Murphy-Sweet,  2013,  para.  2). 
Flowever,  financial  auditability  is  not  the  only  goal.  Strong  and  effective  internal 
controls,  competent  people,  and  capable  processes  are  imperative  to  auditability 
and  form  the  basis  for  the  auditability  triangle,  which  is  illustrated  in  Figure  1 
(Rendon  &  Rendon,  2014).  The  focus  of  this  research  is  the  internal  controls  part  of 
the  auditability  triangle. 
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Figure  1.  Auditability  Triangle 

(Rendon  &  Rendon,  2014) 

In  relationship  to  internal  controls,  the  SOX  and  the  COSO  are  addressed 

next. 


2.  Sarbanes-Oxley  Act  of  2002 

President  George  H.  W.  Bush  signed  the  SOX  into  law  in  2002  (Securities 
and  Exchange  Commission  [SEC],  2013).  The  SOX  was  enacted  to  “protect 
investors  by  improving  the  accuracy  and  reliability  of  corporate  disclosures  made 
pursuant  to  the  securities  laws,  and  for  other  purposes”  (Sarbanes-Oxley  Act, 

2002).  More  specific  to  internal  controls.  Section  404  addresses  management 
assessment  of  internal  controls.  Subsections  (a)  and  (b)  relate  to  the  rules  and 
evaluation  and  reporting.  Section  404(a)  mandated  that  each  annual  report  would 
require  an  internal  control  report  including  a  statement  of  management’s 
responsibility  for  the  internal  control  structure  and  procedures  as  well  as  an 
assessment  of  the  internal  control  structure  at  year  end  (Sarbanes-Oxley  Act,  2002, 
§  7262(a)).  Section  404(b)  states  that  with  regard  to  the  requirements  in  Subsection 
(a),  “each  public  accounting  firm  that  prepares  or  issues  the  audit  report  for  the 
issuer  shall  attest  to,  and  report  on,  the  assessment  made  by  the  management  of 
the  issuer”  (2002,  §  7262(b)).  Although  SOX  set  standards  for  public  companies  and 
public  accounting  firms  to  ensure  that  management  creates,  maintains,  and 
assesses  its  internal  control  structure,  the  internal  control  requirements  are 
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applicable  to  private  companies  as  well  as  the  federal  government.  An  organization 
that  provides  guidance  on  internal  controls  is  addressed  next. 

3.  Committee  of  Sponsoring  Organizations  of  the  Treadway 
Commission 

The  COSO  (n.d.-a)  was  organized  in  1985  and  consists  of  five  professional 
associations  dedicated  to  providing  comprehensive  frameworks  and  guidance  on 
internal  controls  to  improve  organizational  performance  and  governance:  the 
American  Accounting  Association  (AAA);  America,  Institute  of  Certified  Public 
Accountants  (AlCPA);  Financial  Executives  International  (FEI);  The  Institute  of 
Management  Accountants  (IMA);  and  the  Institute  of  Internal  Auditors  (IIA;  COSO, 
n.d.-b).  COSO’s  (n.d.-a)  website  states  that  the  organization’s  “goal  is  to  provide 
thought  leadership  with  three  interrelated  subjects:  enterprise  risk  management 
(ERM),  internal  control,  and  fraud  deterrence”  (para.  6).  The  five  components  of  an 
integrated  internal  control  system  are  discussed  next  as  outlined  by  the  COSO  and 
GAO. 

F.  INTERNAL  CONTROLS 

Internal  controls  in  the  government  are  a  continuous  built-in  component  of 
operations.  They  are  standards  in  place  to  ensure,  with  reasonable  assurance,  that 
an  organization’s  objectives  are  met  to  improve  accountability  and  to  address  areas 
of  risk  in  the  organization.  The  definition  of  the  internal  control  framework,  along  with 
the  components  and  principles  of  internal  control,  are  discussed  next. 

Internal  control  is  a  process  designed  to  provide  reasonable  assurance  that 
an  organization  will  achieve  “effectiveness  and  efficiency  of  operations,  reliability  of 
financial  reporting,  and  compliance  with  applicable  laws  and  regulations”  (COSO, 
2013;  GAO,  1999,  p.  4).  Further,  “there  is  a  direct  relationship  between  the  three 
categories  of  objectives,  which  are  what  an  entity  strives  to  achieve,  and 
components,  which  represent  what  is  needed  to  achieve  the  objectives”  (COSO, 
1992,  p.  3). 

Snyder,  Broome,  and  Zimmerman  (1989)  emphasized  that  “finding  the 
appropriate  level  of  internal  control  is  a  critical  management  responsibility”  (p.  49). 
Salerno  (2006)  found  that  “appropriate,  properly  functioning  internal  controls  offer 
powerful  benefits”  to  organizations  in  many  ways  (p.  1).  Furthermore,  Snyder  et  al. 
(1989)  stated  that  “internal  control  must  be  used  in  a  consistent  manner”  throughout 
the  organization  (p.  48). 

The  five  components  of  an  integrated  internal  control  framework  are  control 
environment,  risk  assessment,  information  and  communication,  control  activities, 
and  monitoring  activities  (COSO,  2013).  Recently,  COSO  (2013)  released  an 
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updated  Internal  Control — Integrated  Framework  (Framework),  which  identifies  17 
principles  that  represent  fundamental  concepts  within  each  component.  Appendix  B 
reflects  the  integrated  internal  control  components  and  related  principles  (Tan, 

2013).  In  addition,  the  Government  Accountability  Office  (GAO,  2013)  exposure  draft 
incorporates  the  new  COSO  guidelines,  which  are  discussed  later.  Each  of  the  five 
internal  control  components  and  17  principles  are  discussed  in  the  following 
sections. 

1.  Control  Environment 

The  control  environment  is  the  first  internal  control  component  and  is 
considered  the  foundation  of  any  internal  control  system  as  well  as  the  entire 
organization.  Management  and  employees  are  responsible  for  establishing  and 
maintaining  an  environment  that  sets  a  positive  tone  toward  internal  controls  (GAO, 
2001 ).  There  are  several  key  factors  that  support  the  achievement  of  this  goal, 
including  integrity  and  ethical  values,  commitment  to  competence,  management’s 
operating  style,  and  organizational  structure.  Management  must  establish  a  tone  at 
the  top  that  values  ethical  behavior  and  integrity  and  must  ensure  that  the  desired 
behaviors  are  communicated  throughout  the  organization.  Holmes,  Langford,  Welch, 
and  Welch  (2002)  proposed  that  management  must  encourage  cooperation  in 
achieving  a  moral  purpose  through  ethical  behavior.  Therefore,  a  strong,  supportive 
attitude  by  management  toward  tight  internal  controls  should  discourage  unethical 
activity  (Holmes  et  al.,  2002).  Management  should  also  take  timely  and  appropriate 
action  as  soon  as  there  are  signs  that  a  problem  may  exist  (GAO,  2001). 

The  organization  must  also  seek  competence  for  its  workforce.  This  entails 
identifying  suitable  knowledge  and  skills  needed  for  various  jobs  and  providing  the 
required  training  (GAO,  1999).  Furthermore,  management’s  philosophy  and 
operating  style  affect  the  environment,  as  the  philosophy  and  operation  style 
determine  the  organization’s  attitude  toward  risk-taking  and  performance-based 
management.  These  factors  can  have  a  great  impact  on  internal  control.  A  study  by 
Fleak,  Harrison,  and  Turner  (2010)  illustrated  “how  weaknesses  in  the  control 
environment  component  of  the  COSO  framework  can  cause  or  exacerbate 
weaknesses  in  the  control  activities,  information  and  communications,  and 
monitoring  components  of  the  framework”  (p.  715).  The  organization  must  have 
clearly  defined  reporting  relationships  and  clearly  defined  authority  and 
responsibility,  and  must  ensure  that  the  organization  is  appropriately  centralized  or 
decentralized  (GAO,  2001).  Additionally,  Fleak  et  al.  (2010)  illustrated  that  “internal 
control  is  vital  for  organizations  of  all  sizes”  (p.  714).  Each  of  the  five  internal  control 
component  sections  discusses  the  associated  principles  outlined  in  the  COSO 
(2013)  framework.  The  principles  relating  to  control  environment  are  as  follows: 
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•  Principle  1 — The  organization  demonstrates  a  commitment  to  integrity 
and  ethical  values. 

•  Principle  2 — The  board  of  directors  demonstrates  independence  from 
management  and  exercises  oversight  of  the  development  and 
performance  of  internal  control. 

•  Principle  3 — Management  establishes,  with  board  oversight, 
structures,  reporting  lines,  and  appropriate  authorities  and 
responsibilities  in  the  pursuit  of  objectives. 

•  Principle  4 — The  organization  demonstrates  a  commitment  to  attract, 
develop,  and  retain  competent  individuals  in  alignment  with  objectives. 

•  Principle  5 — The  organization  holds  individuals  accountable  for  their 
internal  control  responsibilities  in  the  pursuit  of  objectives,  (p.  6) 

2.  Risk  Assessment 

Risk  assessment  is  the  second  internal  control  component  which  includes  the 
“identification,  analysis,  and  management  of  risk”  (Chang,  2013,  p.  16)  associated 
with  an  organization.  Risk  could  inhibit  the  organization’s  efficient  and  effective 
ability  to  achieve  its  objectives.  Risk  identification  includes  recognizing  significant 
interactions  between  the  organization  and  external  factors  as  well  as  internal  factors 
at  both  the  entity  level  and  activity  level.  Other  factors  identified  that  may  contribute 
to  risks  are  activities  related  to  past  failures,  the  inherent  nature  of  the  organization’s 
mission,  and  the  complexity  of  programs  (GAO,  2001 ).  The  analysis  of  risk  also 
includes  estimating  the  significance  of  the  risk  and  assessing  the  likelihood  and 
frequency  of  the  risk  (GAO,  2001).  When  analyzing  risk,  management  needs  to 
develop  a  tolerable  level  of  risk  for  the  organization  to  accept  and  manage.  The 
management  of  risk  entails  deciding  which  internal  control  activities  would  best 
mitigate  those  risks  and  helps  achieve  the  internal  control  objectives  of  efficient  and 
effective  operations,  reliable  financial  reporting,  and  compliance  with  laws  and 
regulations  (GAO,  2001).  The  new  COSO  (2013)  Framework  principles  relating  to 
risk  assessment  are  listed  as  follows: 

•  Principle  6 — The  organization  specifies  objectives  with  sufficient  clarity 
to  enable  the  identification  and  assessment  of  risks  relating  to 
objectives. 

•  Principle  7 — The  organization  identifies  risks  to  the  achievement  of  its 
objectives  across  the  entity  and  analyzes  risks  as  a  basis  for 
determining  how  the  risks  should  be  managed. 
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•  Principle  8 — The  organization  considers  the  potential  for  fraud  in 
assessing  risks  to  the  achievement  of  objectives. 

•  Principle  9 — The  organization  identifies  and  assesses  changes  that 
could  significantly  impact  the  system  of  internal  control,  (p.  7) 

3.  Control  Activities 

Control  activities  is  the  third  internal  control  component  and  consists  of  the 
“policies,  procedures,  techniques,  and  mechanisms  to  ensure  that  management’s 
directives  for  the  organization  are  carried  out”  (GAO,  1999,  p.  11).  The  policies, 
procedures,  techniques,  and  mechanisms  are  also  intended  to  mitigate  the  risk 
identified  in  the  risk  assessment  process.  Control  activities  take  place  at  all  levels  of 
an  organization,  which  include  a  variety  of  activities.  A  manager  should  consider 
“whether  control  activities  relate  to  the  risk-assessment  process  and  whether  they 
are  appropriate  to  ensure  the  management’s  directives  are  carried  out”  (GAO,  2001, 
p.  33).  A  reviewer  within  the  organization  determines  if  the  proper  control  activities 
are  in  place,  if  there  are  a  sufficient  amount  of  control  procedures,  and  if  they  are 
functioning  effectively.  It  is  important  to  establish  control  activities,  but  also  to 
understand  them,  monitor  them,  and  ensure  they  are  being  applied  appropriately 
and  working  properly. 

Other  common  categories  of  control  activities  include  management  of  human 
capital,  performance  measures,  and  segregation  of  duties.  It  is  imperative  that  the 
organization’s  mission,  expectations,  and  strategies  be  clearly  communicated  to  all 
employees  so  that  the  organization  can  manage  the  workforce  to  achieve  its  goals. 
Performance  measures  should  be  established  throughout  the  organization  and 
continually  compared  against  planned  goals  to  assess  progress.  Performance 
measures  are  also  used  for  operational  and  financial  reporting  purposes. 

Segregation  of  duties  can  help  to  reduce  the  risk  of  fraud,  waste,  and  abuse,  but 
solely  “relying  on  segregation  of  duties  where  the  control  environment,  monitoring,  or 
risk  assessment  is  weak  is  negligent”  (McCuaig  &  Marks,  2005,  p.  37).  All  of  these 
factors  impact  an  organization’s  internal  control  activities,  “which  should  be  designed 
accordingly  to  contribute  to  the  achievement  of  the  organization’s  missions,  goals, 
and  objectives”  (GAO,  2001,  p.  33).  In  addition  to  the  control  activities  discussed,  the 
following  are  the  COSO  (2013)  Framework  principles  relating  to  control  activities: 

•  Principle  10 — The  organization  selects  and  develops  control  activities 
that  contribute  to  the  mitigation  of  risks  to  the  achievement  of 
objectives  to  acceptable  levels. 

•  Principle  1 1 — The  organization  selects  and  develops  general  control 
activities  over  technology  to  support  the  achievement  of  objectives. 
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•  Principle  12 — The  organization  deploys  control  activities  through 
policies  that  establish  what  is  expected  and  procedures  that  put 
policies  into  action,  (p.  7) 

4.  Information  and  Communication 

Information  and  communication  is  the  fourth  internal  control  component. 
Information  and  communication  is  the  collection  of  information  that  is  sent  to  all  the 
organization’s  stakeholders  through  the  appropriate  channels,  both  internal  and 
external.  Information  needs  to  be  “identified,  captured,  and  distributed  to  the  right 
people  in  sufficient  detail,  in  the  right  form,  and  at  the  appropriate  time  to  enable 
them  to  carry  out  their  duties  and  responsibilities  efficiently  and  effectively”  (GAO, 
2001,  p.  51).  Managers  need  two  types  of  information:  operating  and  financial  (GAO, 
2001).  Operating  information  is  used  to  determine  compliance  with  various  laws  and 
regulations,  whereas  financial  information  is  used  to  make  operating  decisions  on  a 
daily  basis  and  allocate  resources.  Information  and  communication  also  includes  an 
organization’s  accounting  system.  An  effective  information  and  communication 
system  should  allow  information  to  flow  up,  down,  and  across  the  organization 
(GAO,  1999).  Williams  (2005)  contends  that  “information  and  communication  hold 
the  COSO  framework  together.  Collecting,  analyzing,  and  using  performance 
measures  for  decisions  are  activities  that  require  internal  controls  to  ensure  the  data 
used  are  valid  and  reliable”  (pp.  16-17). 

Management  should  ensure  that  internal  and  external  communications  are 
taken  seriously,  that  there  is  a  means  of  communication  outside  the  direct 
supervisor,  and  that  employees  know  how  their  roles  fit  into  the  overall  structure  of 
the  organization.  The  organization  should  “continually  improve  the  usefulness  and 
reliability  of  its  communication  of  information”  (GAO,  2001,  p.  55)  because  it  is 
connected  to  the  organization’s  overall  strategic  plan  and  is  consequently  linked  to 
the  accomplishment  of  the  organization’s  objectives.  In  addition  to  the  components 
of  information  and  communication  discussed,  the  COSO  (2013)  Framework 
principles  relating  to  information  and  communication  are  as  follows; 

•  Principle  13 — The  organization  obtains  or  generates  and  uses 
relevant,  quality  information  to  support  the  functioning  of  internal 
control. 

•  Principle  14 — The  organization  internally  communicates  information, 
including  objectives  and  responsibilities  for  internal  control,  necessary 
to  support  the  functioning  of  internal  control. 

•  Principle  15 — The  organization  communicates  with  external  parties 
regarding  matters  affecting  the  functioning  of  internal  control,  (p.  7) 
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5.  Monitoring  Activities 

Monitoring  activities  is  the  fifth  internal  control  component  and  is  the  process 
of  assessing  the  quality  of  an  organization’s  performance  over  time.  Williams  (2005) 
identified  monitoring  as  “the  process  of  assessing  the  quality  of  internal  control 
performance.  Monitoring  is  also  the  routine  review  of  the  effectiveness  of  internal 
controls  and  is  perhaps  the  most  important  part  of  the  COSO  framework”  (p.  17). 
Monitoring  is  accomplished  through  ongoing  monitoring,  separate  evaluations,  or  a 
combination  of  the  two.  Ongoing  monitoring  is  performed  continually  and  is 
embedded  in  the  organization’s  normal  operations.  It  includes  “regular  management 
and  supervisory  activities,  comparisons,  reconciliations,  and  other  actions  people 
take  in  performing  their  duties”  (GAO,  1999,  p.  20).  Separate  evaluations  are  a  more 
in-depth  review  of  a  single  internal  control  process  at  a  specific  point  in  time. 
Separate  evaluations  can  be  conducted  by  an  internal  individual  as  a  self- 
assessment  or  by  an  external  auditor.  Any  internal  control  deficiencies  that  are  found 
need  to  be  reported  to  the  person  responsible  for  that  function  and  his  or  her 
supervisor  for  immediate  resolution. 

Audit  resolution  includes  findings  and  recommendations  from  formal  audits, 
informal  reviews,  internal  separate  evaluations,  and  management  studies  and 
assessments  (GAO,  2001).  The  organization  should  be  responsive  to  these 
recommendations,  find  ways  to  strengthen  its  internal  controls,  and  take  appropriate 
action  to  follow  up  and  resolve  any  issues.  The  COSO  Framework  (2013)  updated 
this  component  to  “Monitoring  Activities”  in  2013,  discussing  the  same  concepts, 
with  the  addition  of  the  following  principles: 

•  Principle  16 — The  organization  selects,  develops,  and  performs 
ongoing  and/or  separate  evaluations  to  ascertain  whether  the 
components  of  internal  control  are  present  and  functioning. 

•  Principle  17 — The  organization  evaluates  and  communicates  internal 
control  deficiencies  in  a  timely  manner  to  those  parties  responsible  for 
taking  corrective  action,  including  senior  management  and  the  board  of 
directors,  as  appropriate,  (p.  7) 

The  previous  sections  discussed  the  five  internal  control  components  and  the 
corresponding  principles  in  accordance  with  the  updated  COSO  Framework.  These 
five  components  of  internal  control  are  important  to  the  purchase  card  program’s 
success  because  the  absence  of  effective  internal  controls  can  expose  the  program 
to  inefficiencies  and  vulnerabilities  to  fraud  (Rendon,  2011,  p.  11).  The  next  section 
discusses  the  GAO  standards  in  the  GAO  2013  exposure  draft  as  they  were 
developed  from  and  relate  to  the  COSO  Framework. 
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G. 


INTERNAL  CONTROLS  IN  THE  FEDERAL  GOVERNMENT 


1.  Government  Accountability  Office  Internal  Control  Framework 

The  GAO  internal  control  framework  is  the  COSO  Framework  applied  to  the 
federal  government.  Prior  GAO  reports  were  referenced  in  the  previous  sections  of 
discussion  of  the  internal  control  components;  however,  a  new  set  of  internal 
controls  standards  was  released  by  the  GAO  (2013)  as  an  exposure  draft  of  the 
Standards  for  Internal  Control  in  the  Federal  Government  {Green  Book)  that 
implements  the  new  COSO  integrated  internal  control  framework.  The  GAO  is 
currently  in  the  process  of  updating  the  Green  Book.  The  GAO  exposure  draft  of  the 
Green  Book  was  open  to  the  public  for  comments  through  February  18,  2014,  so  the 
GAO  will  be  releasing  the  new  standards  sometime  this  year,  which  will  supersede 
the  1999  edition  of  the  Green  Book.  These  standards  provide  the  framework  for 
establishing  and  maintaining  effective  internal  controls  in  the  federal  government 
(GAO,  2013). 

The  goal  is  to  develop  an  effective  internal  control  system  to  achieve  an 
organization’s  goals;  however,  it  is  imperative  to  understand  that  the  control  system 
can  only  provide  reasonable  assurance,  not  absolute  assurance,  that  those 
objectives  will  be  met.  The  GAO  2013  exposure  draft  details  the  implementation  of 
the  internal  control  components  and  principles  in  a  federal  government  environment 
similar  to  the  implementation  discussed  in  the  previous  sections.  The  next  section 
discusses  the  Managers’  Internal  Control  Program  (MICP),  which  is  another  tool 
used  to  hold  federal  managers  accountable  for  their  internal  control  system. 

2.  Managers’  Internal  Control  Program 

The  Federal  Managers’  Financial  Integrity  Act  (FMFIA)  of  1982  was  signed 
into  law  to  ensure  that  agencies  were  conducting  ongoing  evaluations  and  reporting 
on  the  adequacy  of  their  internal  control  systems.  The  Office  of  the  Under  Secretary 
of  Defense  (Comptroller;  OUSD[C])  is  responsible  for  implementing,  managing,  and 
monitoring  the  secretary  of  defense’s  program  over  internal  control  management 
(2013).  Although  the  USD(C)  is  responsible  for  the  program,  he/she  instructs  the 
director  of  financial  improvement  and  audit  readiness  (DFIAR)  to  manage  and 
oversee  operations  of  the  DoD’s  MICP  (CUSD[C]/Chief  Financial  Cfficer,  2013).  The 
FMFIA  is  implemented  through  the  DoD  MICP  (CUSD[C],  2013).  The  MICP  requires 
all  DoD  managers  to  be  involved  in  the  program  and  remain  active  participants  to 
“review,  assess,  and  report  on  the  effectiveness  of  internal  management  controls 
within  their  command”  (CUSD[C],  2013,  p.  1).  The  MICP  is  the  Navy’s  method  for 
demonstrating  compliance  with  the  FMFIA,  and  it  is  crucial  to  stay  in  compliance 
with  this  program  because  the  command  compliance  will  be  reviewed  and  evaluated 
during  external  audits  and  inspections  (NPS,  2013a). 
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NPS  Instruction  5200.1  S  states,  as  outlined  in  Title  31  of  the  United  States 
Code  (U.S.C.)  §  3512  (201 1 ),  the  following  regarding  internal  controls: 

commands  [are  required]  to  implement  a  system  of  internal  controls  to 
provide  reasonable  assurance  that  programs  achieve  their  intended 
results;  resource  use  is  consistent  with  the  Department  of  the  Navy 
mission;  programs  and  resources  are  protected  from  waste,  fraud,  and 
mismanagement;  laws  and  regulations  are  followed;  and  reliable  and 
timely  information  is  obtained,  maintained,  and  used  for  decision¬ 
making  and  reporting.  (NPS,  2013a,  p.  1) 

The  implementation  of  internal  control  systems  was  previously  required  of 
federal  managers,  but  now  reporting  is  an  additional  obligation  and  will  continue  to 
be  a  requirement  to  support  the  auditability  of  the  DoD.  The  0MB  (2009)  Circular  A- 
123  and  its  Appendix  B  further  discusses  management’s  responsibility  for  internal 
controls. 

3.  Office  of  Management  and  Budget  Circular  A-123 

0MB  (2004)  Circular  A-123,  Management’s  Responsibility  for  Internal 
Control,  was  previously  named  Management  Accountability  and  Control.  It  outlined 
and  defined  management’s  responsibility  for  internal  control  in  the  federal 
government.  This  revision  of  the  circular  was  written  in  2004  after  the  new 
requirements  for  publicly  traded  companies  were  established  in  the  SOX;  however, 
the  circular  was  not  implemented  until  FY2006.  Agencies  were  given  time  to  prepare 
for  its  implementation,  and  in  the  interim  followed  the  previous  version  of  Circular  A- 
123  (0MB,  2004).  The  revised  0MB  Circular  A-123  was  to  supersede  all  previous 
versions  once  implemented.  At  the  time,  this  circular  and  the  statute  it  implemented, 
FMFIA  of  1982,  were  the  core  federal  requirements  to  improve  internal  controls 
(0MB,  2004).  The  content  of  the  circular  was  meant  to  strengthen  the  requirements 
for  assessment  of  internal  controls  and  emphasize  the  connection  between  internal 
control  assessments  and  internal  control-related  activities  (0MB,  2004). 

Appendix  B  of  Circular  A-123  was  “Improving  the  Management  of 
Government  Charge  Card  Programs”  (0MB,  2004).  The  revised  Appendix  B  outlined 
policies  and  procedures  regarding  how  to  maintain  internal  controls  in  government 
charge  card  programs  (0MB,  2009).  It  established  minimum  requirements  and 
identified  best  practices  from  all  issuing  agencies,  such  as  the  0MB,  GSA, 
Department  of  Treasury,  and  others.  The  goal  of  the  guidance  was  to  improve  the 
GPCP  and  maximize  the  benefits  to  the  federal  government.  Benefits  included 
reduction  of  administrative  costs,  decrease  in  transaction  time  and  costs,  mitigation 
of  risks,  improvement  of  financial  and  administrative  processes,  and  policy 
compliance  monitoring  (0MB,  2009).  The  information  contained  in  the  0MB  Circular 
A-123  Appendix  B  must  be  distributed  to  all  employees  in  the  purchase  card 
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program  and  “included  in  internal  agency  procedures  and  training  materials”  (0MB, 
2009,  p.  3). 

H.  SUMMARY 

This  literature  review  presented  a  background  of  the  research  with  an 
overview  of  the  evolving  role  of  the  purchasing  function.  It  also  presented  the 
industry  purchase  card  program  and  its  associated  roles  and  responsibilities.  In 
addition,  the  GPCP  and  its  application  in  the  federal  government,  the  DoD,  and  the 
DoN  were  discussed.  Corporate  governance,  which  includes  auditability,  the  SOX, 
and  COSO  were  addressed.  Furthermore,  the  integrated  internal  control 
components  were  discussed  and  as  well  as  internal  controls  in  the  federal 
government. 

The  next  chapter  introduces  the  Naval  Postgraduate  School  (NPS)  and  its 
use  of  the  GPCP.  NPS  is  the  focal  organization  for  this  research  on  the  analysis  of 
perceptions  of  internal  controls  in  the  GPCP. 
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III.  NAVAL  POSTGRADUATE  SCHOOL 


A.  INTRODUCTION 

The  Naval  Postgraduate  School  (NPS)  is  located  in  Monterey,  CA.  The 
school  provides  graduate  education  to  U.S.  and  foreign  military  officers  and 
government  employees.  NPS’s  mission  is  to  “provide  relevant  and  unique  advanced 
education  and  research  programs”  (Office  of  the  Chief  of  Naval  Operations  [CNO], 
2012,  p.  3),  and  through  this  mission,  NPS  fulfills  the  graduate  education  needs  of 
the  Department  of  Defense  (DoD).  The  institution  is  comprised  of  four  schools, 
several  departments,  and  a  number  of  centers,  all  of  which  have  staff,  faculty,  and 
students  with  purchasing  requirements  who  are  working  to  accomplish  their  specific 
missions,  which  support  NPS’s  mission. 

The  staff  at  the  school  supports  the  operations  of  NPS  in  functional  areas 
including,  but  not  limited  to,  contracting  and  purchasing.  The  Department  of 
Contracting  and  Logistics  governs  the  contracting  and  purchasing  functions  for  all  of 
NPS,  and  the  staff  in  the  department  supports  the  purchasing  requirements  for  NPS 
schools,  departments,  and  centers.  This  chapter  provides  a  discussion  of  the 
Contracting  and  Logistics  Department  and  NPS’s  purchasing  organizational 
structure.  Finally,  the  GPCP  at  NPS  is  discussed,  including  the  span  of  control, 
training  requirements,  and  administrative  actions  for  noncompliance. 

B.  CONTRACTING  AND  LOGISTICS  MANAGEMENT 

A  recently  released  NPS  instruction  states,  “Under  the  direction  of  the 
Director  of  Contracting  and  Logistics  Management,  the  Contracting  and  Logistics 
Management  organization  provides  procurement  and  contracting  support  for  the 
acquisition  of  supplies  and  services  for  the  Naval  Postgraduate  School”  (NPS, 
2013b,  p.  13).  The  organization  was  recently  restructured  to  enhance  efficiency  and 
effectiveness  within  the  department,  as  well  as  provide  clarity  for  the  employees  and 
end  users.  As  previously  mentioned,  all  staff,  faculty,  and  students  have  purchasing 
requirements  in  order  to  complete  their  specific  missions,  which  support  NPS’s 
mission.  To  accomplish  the  mission  of  NPS,  the  staff  involved  in  the  purchasing 
function  must  be  properly  equipped  with  the  right  tools.  The  purchasing 
organizational  structure,  which  differentiates  the  two  types  of  purchasing  support 
provided  at  NPS,  is  discussed  next. 

C.  PURCHASING  ORGANIZATIONAL  STRUCTURE  AT  THE  NAVAL 
POSTGRADUATE  SCHOOL 

Purchasing  in  support  of  NPS  is  organized  into  a  hybrid  structure,  which  is  an 
organizational  design  that  provides  flexibility  to  meet  changing  business  conditions 
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(Monzcka  et  al.,  2011).  Organizational  design  refers  to  the  process  of  selecting  a 
“structured  and  formal  system”  that  incorporates  communication,  control,  authority, 
and  other  responsibilities  needed  to  accomplish  the  organization’s  goals  (Monzcka 
et  al.,  201 1 ).  Monzcka  et  al.  (201 1 )  contended  that  “one  of  the  most  critical  aspects 
of  organizational  design  is  the  decision  to  centralize  or  decentralize  purchasing 
authority”  (p.  158).  The  purchasing  authority  at  NPS  is  a  hybrid  because  it  has  both 
centralized  and  decentralized  aspects.  The  purchasing  agents  who  are  mostly 
responsible  for  large  orders  ranging  from  $3, 000-$1 50,000  are  centralized,  whereas 
the  purchase  cardholders  (CHs)  who  are  responsible  for  the  small  orders  under  the 
micro-purchase  threshold  of  $3,000  are  decentralized. 

In  FY2012,  the  NPS  Government  Purchase  Card  Program  (GPCP)  was 
responsible  for  making  approximately  21,000  transactions  totaling  approximately 
$24.2  million  (M.  Morales,  personal  communication,  July  24,  2013).  Both  purchasing 
agents  and  government  purchase  CHs  report  to  the  director  of  contracting  and 
logistics  management  (NPS,  2013b).  The  GPCP  at  NPS  is  discussed  next,  which 
includes  span  of  control,  training  requirements,  and  administrative  actions  for 
noncompliance. 

D.  NAVAL  POSTGRADUATE  SCHOOL  GOVERNMENT  PURCHASE  CARD 
PROGRAM 

The  Department  of  Contracting  and  Logistics  Management  owns  the  NPS 
GPCP,  but  the  agency  program  coordinator  (APC)  has  overall  responsibility  of  the 
program  to  ensure  its  integrity  and  success.  The  APC’s  responsibility  is  to  ensure  all 
program  participants,  specifically  approving  officials  (AOs)  and  CHs,  are  properly 
equipped  with  the  knowledge,  skills,  and  abilities  to  accomplish  their  purchasing 
requirements.  The  APC  is  also  responsible  for  tracking  training  completion,  ensuring 
that  proper  oversight  and  management  controls  are  in  place  and  working,  and 
conducting  compliance  reports.  The  APC  is  tasked  with  making  sure  that  AOs  and 
CHs  complete  the  mandatory  training  requirements  (including  refresher  training 
when  necessary),  remain  familiar  with  all  policies  and  procedures  associated  with 
the  program,  and  are  aware  of  the  internal  controls  in  place.  The  following  sections 
discuss  span  of  control,  training  requirements,  and  administrative  actions  for 
noncompliance  regarding  the  GPCP  at  NPS. 

1.  Span  of  Control 

The  NPS  GPCP  is  composed  of  a  total  of  24  AOs  and  32  CHs  dispersed 
throughout  the  campus  to  serve  their  departments’  customers.  The  responsibilities  of 
an  AO  and  a  CH  are  collateral  duties  to  be  performed  in  conjunction  with  primary 
duties.  Given  the  ratio  of  CHs  to  AOs  at  NPS,  an  AO  is  responsible  for  overseeing 
no  more  than  two  CHs,  which  complies  with  current  DoN  regulation  on  span  of 


ACQUISITION  RESEARCH  PROGRAM 

GRADUATE  SCHOOL  OE  BUSINESS  &  PUBLIC  POLICY 

NAVAL  POSTGRADUATE  SCHOOL 


■30- 


control,  which  specifies  that  an  AO  may  not  oversee  more  than  seven  CHs 
(NAVSUP,  2012).  In  addition,  the  DoN  instruction  states  that  an  APC  may  not 
oversee  more  than  300  AOs,  so  NPS  is  also  in  compliance  with  that  requirement. 

2.  Training  Requirements 

NPS  (2012)  Instruction  4410.10  outlines  the  training  requirements  for  its  AOs 
and  CHs.  After  the  passing  of  the  2006  Consolidated  Appropriations  Act,  the 
requirement  for  credit  worthiness  assessments  for  new  CHs  was  eliminated  (DPAP, 
201 1 ;  Rendon,  201 1 ).  However,  agency  officials  and  APCs  are  allowed  to  continue 
implementing  this  requirement  at  their  discretion  (Rendon,  201 1 ).  Credit  worthiness 
assessments  are  not  required  for  new  CHs  at  NPS. 

Required  training  for  AOs  and  CHs  at  NPS  align  with  the  requirements  for  the 
DoN.  Those  requirements  include  a  course  from  the  Defense  Acquisition  University 
(DAU),  online  DoN  purchase  card  training  for  their  specific  role,  and  DoD  ethics 
training  (NAVSUP,  2012).  In  addition,  purchase  card  refresher  training  is  required 
every  two  years,  which  can  be  completed  through  the  Consolidated  Card  Program 
Management  Division  (CCPMD)  sponsored  regional  training,  specific  DAU  courses, 
or  online  DoN  purchase  card  training.  Furthermore,  DoD  annual  ethics  training  is 
required  as  well.  Initial  training  with  Citibank  is  required,  and  NPS  also  requires  that 
all  purchase  card  personnel  attend  local  annual  procedures  training.  Lastly,  all  new 
cardholders  must  complete  a  class  on  using  Funds  Administration  and  Standardized 
Document  Automation  (FASTDATA)  and  the  Kuali  Financial  System  (KFS).  The 
FASTDATA  is  used  as  NFS’s  financial  management  tool  to  input  purchase  card 
transactions  into  the  Standard  Accounting  and  Reporting  System  (STARS).  The  KFS 
is  used  as  the  business  management  system  for  NPS  (NPS,  2013b). 

3.  Administrative  Actions  for  Noncompliance 

If  the  AC  and/or  CH  do  not  comply  with  appropriate  regulations  and  policies, 
administrative  actions  will  be  taken.  NPS  (2008)  Instruction  4200. 1A,  titled  Navy 
Purchase  Card  Rule  Violations  and  Applicable  Administrative  Actions,  identifies  two 
types  of  card  violations  and  associated  administrative  actions.  The  APC  is 
responsible  for  informing,  investigating,  and  confirming  all  violations  to  the 
appropriate  leadership  (NPS,  2008).  Category  “A”  violations  occur  when  ACs  and 
CHs  fail  to  adhere  to  proper  record  keeping  and  training  requirements,  whereas 
Category  “B”  violations  occur  when  ACs  and  CHs  violate  purchasing  rules  and 
regulations.  The  administrative  actions  for  a  Category  A  violation  depend  on  whether 
it  is  the  first,  second,  or  third  violation.  The  first  violation  requires  corrective  action, 
the  second  violation  may  result  in  a  suspended  account  and  required  remedial 
training,  and  the  third  violation  results  in  a  cancelled  account  for  the  CH  and  a 
suspended  account  for  the  AC.  Based  on  the  results  of  a  Category  B  violation,  the 
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comptroller  may  immediately  cancel  the  account  and  provide  guidance  and 
additional  training  (NPS,  2008). 

E.  SUMMARY 

This  chapter  presented  a  brief  overview  of  NPS,  including  its  mission  and 
purchasing  requirements.  In  addition,  a  discussion  of  the  Contracting  and  Logistics 
Department  and  its  purchasing  organizational  structure  was  provided.  Finally,  the 
GPCP  at  NPS  was  discussed  including  the  span  of  control,  training  requirements, 
and  administrative  actions  for  noncompliance.  The  next  chapter  presents  the 
methodology  of  this  research. 


ACQUISITION  RESEARCH  PROGRAM 

GRADUATE  SCHOOL  OE  BUSINESS  &  PUBLIC  POLICY 

NAVAL  POSTGRADUATE  SCHOOL 


■32- 


IV.  METHODOLOGY 


A.  INTRODUCTION 

This  chapter  provides  an  outline  of  the  methodology  used  to  conduct  this 
research  study.  The  method  used  to  develop  the  survey,  the  sources  used  to 
develop  the  individual  questions  used  in  the  survey  instrument,  and  the  deployment 
of  the  survey  are  discussed.  The  process  used  to  analyze  the  data  is  also 
addressed. 


B.  SURVEY  DEVELOPMENT 

The  survey  was  developed  using  two  sources.  The  first  source  was  a 
previously  validated  survey  developed  by  the  New  York  State  Internal  Control 
Association  (NYICA;  201 1 ).  Questions  from  the  survey  that  were  most  pertinent  to 
the  five  components  of  internal  control  were  utilized.  The  second  source  was 
questions  developed  by  the  research  team.  Demographic  questions  and  additional 
questions  based  on  the  information  provided  in  the  literature  review  conducted  on 
the  government  purchase  card  program  were  developed.  The  survey  consisted  of  69 
Likert-based  survey  items  with  seven  options  ranging  from  “Strongly  Agree”  to 
“Strongly  Disagree.”  The  participants  also  had  the  option  to  choose  “I  don’t  know”  or 
“I  prefer  not  to  answer,”  which  were  part  of  the  seven  options. 

The  survey  was  developed  to  analyze  the  approving  officials’  (AOs’)  and 
cardholders’  (CHs’)  perceptions  of  internal  controls  within  the  purchase  card 
program  at  the  Naval  Postgraduate  School  (NPS).  First,  the  demographic  questions 
addressed  the  participants’  employment  category,  position  in  the  Government 
Purchase  Card  Program  (GPCP),  time  in  their  position,  numbers  of 
schools/departments/people  they  support  or  oversee,  and  percentage  of  their 
working  hours  that  were  spent  conducting  GPCP  collateral  duties.  Second,  the 
survey  focused  on  questions  relating  to  the  five  components  of  the  Committee  of 
Sponsoring  Organization  of  the  Treadway  Commission  (COSO)  integrated  internal 
control  framework  to  include  control  environment,  risk  assessment,  control  activities, 
information  and  communication,  and  monitoring  activities. 

Control  environment  survey  items  relate  to  ethical  standards,  trust, 
management’s  conduct,  training  requirements  and  knowledge,  and  overall  work 
environment.  Risk  assessment  survey  items  relate  to  accountability,  sufficient 
resources,  and  factors  that  may  affect  the  employee’s  work  environment  and  ability 
to  complete  his  or  her  duties.  Control  activities  survey  items  relate  to  current  policies 
and  procedures,  the  process  for  reporting,  the  knowledge  of  consequences, 
supervision,  and  computer  systems’  security.  Information  and  communication  survey 
items  relate  to  the  interaction  between  management  and  work  units,  knowledge  of 
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expected  behavior  and  performance,  channels  of  communication,  and  the  process  of 
sharing  information  to  reach  their  units’  objectives.  Monitoring  activities  survey  items 
relate  to  output  measurability  and  performance  reviews,  reviews  of  policies  and 
practices,  and  program  oversight. 

Finally,  there  were  three  open-ended  questions  at  the  end  of  the  survey.  The 
open-ended  questions  asked  the  participant  to  list  or  describe  the  top  five  critical 
success  factors  needed  for  an  organization  to  achieve  its  mission  for  the  GPCP,  to 
list  or  describe  the  top  five  issues  that  could  hinder  the  success  of  the  GPCP,  and  to 
explain  why  he  or  she  disagreed  or  strongly  disagreed  with  any  of  the  survey 
questions. 

C.  SURVEY  DEPLOYMENT 

The  survey  was  deployed  to  AOs  and  CHs  in  the  purchase  card  program  at 
NPS.  Each  participant  was  sent  an  e-mail  with  a  link  to  the  web-based  survey  on 
LimeSurvey.  The  survey  was  voluntary  and  anonymous.  No  personally  identifiable 
information  was  collected.  All  participants  were  given  permission  to  complete  the 
survey  at  their  workstation  and  during  work  hours.  The  survey  was  available  for 
three  weeks.  Once  the  survey  was  closed,  the  researchers  collected  the  responses 
from  LimeSurvey  to  conduct  an  analysis  of  the  data.  The  population  consisted  of  56 
potential  participants,  13  of  whom  submitted  a  complete  survey;  therefore,  the 
survey  participation  rate  was  23%. 


D.  PROCESS  USED  TO  ANALYZE  DATA 

Because  of  the  low  participation  rate,  the  data  was  analyzed  using  only 
descriptive  statistics.  The  collected  data  was  analyzed  using  IBM  SPSS  Statistics 
Version  19.  The  responses  were  coded  to  assist  with  the  analysis.  Descriptive 
statistics  “involves  arranging,  summarizing,  and  presenting  a  set  of  data  in  such  a 
way  that  useful  information  is  produced.  Its  methods  make  use  of  graphical 
techniques  and  numerical  descriptive  measures  (such  as  averages)  to  summarize 
and  present  the  data”  (Keller,  2009,  p.  12).  The  survey  did  not  ask  knowledge 
questions  because  the  research  study  was  not  assessing  participants’  knowledge  of 
internal  controls;  it  was  simply  identifying  their  perceptions  of  compliance  to  internal 
controls  within  the  NPS  GPCP.  The  data  gathered  from  the  results  were  analyzed  in 
several  different  ways,  as  discussed  later;  however,  the  basis  of  analysis  was  the 
mean,  or  average,  response. 

Initially,  the  overall  frequency  of  the  demographics  questions  is  identified. 
Then,  the  mean  for  each  of  the  five  internal  control  components  are  calculated  and 
presented.  The  mean  is  the  average,  and  the  frequency  is  the  rate  of  occurrence.  In 
addition,  the  five  internal  control  components  are  analyzed  by  the  participants’ 
position  in  the  government,  AO  or  CH,  which  are  used  to  identify  any  differences  in 
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perceptions  of  internal  controls  between  AOs  and  CHs.  Additional  observations 
based  on  other  analysis  are  discussed.  The  frequency  of  “I  don’t  know”  responses  is 
also  discussed.  Finally,  any  potential  implications  of  the  survey  findings  on  internal 
controls  may  have  on  auditability  are  discussed. 

E.  SUMMARY 

This  chapter  provided  an  outline  of  the  methodology  used  to  conduct  this 
research  study.  The  method  used  to  develop  the  survey,  the  sources  used  to 
develop  the  individual  questions  used  in  the  survey  instrument,  and  the  deployment 
of  the  survey  were  discussed.  The  process  used  to  analyze  the  data  was  also 
addressed.  The  next  chapter  discusses  the  results  of  the  research,  provides  an 
analysis  of  the  results,  identifies  any  implications  of  the  research  results,  and 
provides  recommendations  based  on  the  data  analysis. 


ACQUISITION  RESEARCH  PROGRAM 

GRADUATE  SCHOOL  OE  BUSINESS  &  PUBLIC  POLICY 

NAVAL  POSTGRADUATE  SCHOOL 


■35- 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


ACQUISITION  RESEARCH  PROGRAM 

GRADUATE  SCHOOL  OE  BUSINESS  &  PUBLIC  POLICY 

NAVAL  POSTGRADUATE  SCHOOL 


V.  RESULTS,  ANALYSIS,  IMPLICATIONS,  AND 
RECOMMENDATIONS 


A.  INTRODUCTION 

In  this  chapter,  the  results  of  the  online  survey  collected  from  LimeSurvey  are 
presented,  which  include  survey  items  pertaining  to  demographics  and  the  five 
components  of  internal  control:  control  environment,  risk  assessment,  control 
activities,  information  and  communication,  and  monitoring  activities.  The  overall 
population’s  mean  of  the  Likert-based  responses  in  addition  to  the  frequency  of  the 
demographics  survey  items  are  identified.  The  mean  for  each  of  the  five  internal 
control  components  are  also  calculated  and  presented.  The  mean  and  frequency  of 
responses  from  the  approving  officials  (AOs)  and  cardholders  (CHs)  are  compared 
and  analyzed  to  identify  any  differences  in  perceptions  of  internal  controls  between 
AOs  and  CHs.  Additional  analysis  based  on  the  results  is  discussed.  The  open- 
ended  questions  were  not  analyzed  as  part  of  this  research  study.  Furthermore,  any 
potential  implications  of  the  survey  findings  on  internal  controls,  or  lack  thereof,  on 
auditability  within  the  Government  Purchase  Card  Program  (GPCP)  at  the  Naval 
Postgraduate  School  (NPS)  are  addressed.  Finally,  recommendations  based  on  the 
data  analysis  are  presented. 

B.  ANALYSIS  OF  DEMOGRAPHIC  QUESTIONS 

1.  Survey  Response 

The  survey  was  deployed  on  Tuesday,  January  14,  2014,  and  was  open  for 
three  weeks  until  Tuesday,  February  4,  2014.  During  the  time  that  the  survey  was 
available,  13  participants  responded.  The  web-based  survey  link  was  sent  to  56 
people,  so  the  response  rate  was  23%.  All  participants  were  federal  civilian 
employees,  and  out  of  the  13  responses,  six  were  AOs  and  seven  were  CHs.  The 
survey  consisted  of  Likert-based  survey  items  with  seven  options  ranging  from 
“Strongly  Agree”  to  “Strongly  Disagree.”  The  participants  also  had  the  option  to 
choose  “I  don’t  know”  or  “I  prefer  not  to  answer.”  Of  the  total  survey  items,  there 
were  eight  demographics  survey  items,  including  employment  category  and  position, 
which  are  discussed  next. 

2.  Responses  by  Experience 

The  response  options  were  divided  into  six  categories  based  on  years  of 
experience  in  the  role  as  AO  or  CH.  The  options  were  0-1,  2-3,  4-5,  6-7,  8-9,  and 
over  10  years.  Figure  2  displays  the  responses.  Based  on  the  responses, 
approximately  8%  of  participants  indicated  that  they  had  less  than  one  year  of 
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experience,  while  38%  of  the  participants  had  four  to  five  years  of  experience,  and 
23%  had  over  10  years  of  experience. 


■  0-1  years 

■  2-3  years 

■  4-5  years 

■  6-7  years 


■  over  1 0  years 


5 


Figure  2. 


Number  of  Responses  by  Years  of  Experience  as  an  AO  or  CH 


3.  Responses  by  Number  of  Schoois 

The  response  options  were  divided  into  four  categories  based  on  the  number 
of  schools  each  participant  was  responsible  for  in  the  GPCP.  The  options  were  1 ,  2, 
3,  or  4  schools.  Figure  3  displays  the  responses.  Out  of  the  four  possible  options, 
participants  chose  only  two  of  the  available  options.  Based  on  the  responses, 
approximately  77%  of  the  participants  were  responsible  for  one  school  in  the  GPCP, 
while  the  remaining  23%  were  responsible  for  four  schools  in  the  GPCP. 
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Figure  3.  Number  of  Responses  to  Number  of  Schools  Supported 

4.  Responses  by  Number  of  Departments 

The  response  options  were  divided  into  four  categories  based  on  how  many 
departments  each  participant  was  responsible  for  in  the  GPCP.  The  options  were  0- 
3,  4-6,  7-10,  or  more  than  10  departments.  Figure  4  displays  the  responses.  The 
data  shows  that  54%  of  the  participants  were  responsible  for  0-3  departments,  and 
only  15%  were  responsible  for  more  than  10  departments.  The  remaining  31%  were 
responsible  for  4-10  departments;  one  for  4-6  departments  (8%)  and  three  for  7-10 
departments  (23%). 
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Figure  4.  Number  of  Responses  to  Number  of  Departments  Supported 
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5. 


Responses  by  Number  of  People  AO  Oversees 

The  AOs  were  asked  how  many  people  they  oversee  in  the  GPCP.  The 
options  were  0-5,  6-10,  11-15,  16-20,  or  more  than  20  people.  Figure  5  displays 
the  responses.  Based  on  the  responses,  83%  of  the  AOs  oversaw  0-5  people  and 
17%  oversaw  6-10  people.  It  is  important  to  note  that  the  numbers  are  consistent 
with  the  regulation  that  an  AO  may  oversee  no  more  than  seven  CHs. 


Number  of  People  AOs  Oversee 


Figure  5.  Number  of  Responses  by  Number  of  People  AOs  Oversee 


6.  Responses  by  Number  of  People  CH  Supports 

The  CHs  were  asked  how  many  people  they  support  in  the  GPCP.  The 
options  were  0-5,  6-10,  11-15,  16-20,  or  more  than  20  people.  Figure  6  displays 
the  responses.  Based  on  the  responses,  29%  of  CHs  responded  that  they  supported 
0-5  people  and  71%  of  CHs  responded  that  they  supported  more  than  20  people. 
The  number  of  people  each  CH  supported  may  be  related  to  the  size  of  the 
school(s)  and  department(s)  they  each  supported. 
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Number  of  People  CHs  Support 


Figure  6.  Number  of  Responses  by  Number  of  People  CHs  Support 


7.  Responses  by  Percentage  of  Time  Spent  on  Collateral  Duty 

The  participants  were  also  questioned  regarding  the  percentage  of  their 
working  hours  that  were  spent  conducting  GPCP  collateral  duty  assignments.  The 
options  were  100%,  75%,  50%,  25%,  or  less  than  25%.  Figure  7  displays  the 
responses.  Based  on  the  responses,  approximately  46%  of  participants — five  AOs 
and  one  CH — responded  that  they  spent  less  than  25%  of  working  hours  conducting 
GPCP  collateral  duties  and  38%  of  participants,  all  of  whom  were  CHs,  spent  more 
than  75%  of  their  working  hours  conducting  GPCP  collateral  duties.  Only  one 
responded  that  100%  of  their  working  hours  were  spent  conducting  GPCP  collateral 
duty  assignments,  which  implies  that  this  was  not  a  collateral  duty  for  this  one 
person;  it  was  a  full-time  duty. 
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Percentage  of  Working  Hours 


Figure  7.  Number  of  Responses  by  Collateral  Duty  as  Percentage  of 

Working  Hours 

In  this  section,  overall  frequency  data  for  the  demographics  was  presented. 
The  analysis  of  the  data  for  the  five  internal  control  components  is  presented  next. 

C.  ANALYSIS  OF  INTERNAL  CONTROL  QUESTIONS 

The  survey  consisted  of  69  survey  items  relating  to  Committee  of  Sponsoring 
Organization  of  the  Treadway  Commission’s  (COSO)  five  internal  control 
components.  The  mean  calculations  did  not  include  one  survey  item  from  the  risk 
assessment  component  that  only  pertained  to  AOs;  therefore,  68  survey  items  were 
used  in  the  analysis.  During  analysis  of  the  individual  survey  items  within  each 
component,  “I  don’t  know”  responses  were  coded  as  0  (zero  value).  The  “I  don’t 
know”  responses  were  not  included  in  the  mean  calculations.  They  were  converted 
to  blanks  in  the  Excel  spreadsheet  and  were  identified  as  missing  responses  in 
SPSS.  The  open-ended  questions  were  not  analyzed  as  part  of  this  research. 

Figure  8  displays  the  overall  mean  for  each  internal  control  component. 

Based  on  the  survey  results,  risk  assessment  scored  the  lowest  with  a  mean  of  3.2, 
meaning  this  component  had  more  “disagree,”  or  “neither  agree  nor  disagree,” 
responses  to  the  survey  items  pertaining  to  risk  assessment.  Control  activities 
scored  the  highest  with  a  mean  of  3.78,  meaning  this  component  had  more  “agree,” 
or  “neither  agree  nor  disagree”  responses  to  the  survey  items  pertaining  to  control 
activities.  Thus,  the  risk  assessment  controls  were  perceived  to  be  the  weakest  of 
the  five  internal  control  components,  whereas  the  control  activities  were  perceived  to 
be  the  strongest  internal  control  component  within  the  GPCP  at  NPS. 
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Internal  Control  Component 


Figure  8.  Average  Response  by  Internal  Control  Component 

1.  Control  Environment 

As  shown  in  Figure  8,  the  overall  mean  for  the  control  environment 
component  was  3.57,  second  highest  after  control  activities.  Comparing  the  two 
groups,  Figure  9  shows  a  mean  of  3.69  for  AOs  and  3.47  for  CHs. 


Figure  9.  Average  Response  for  Controi  Environment  Component 

2.  Risk  Assessment 

The  lowest  overall  mean  of  the  five  internal  control  components  was  risk 
assessment,  with  a  mean  of  3.2  as  shown  in  Figure  8,  and  that  finding  is 
corroborated  by  the  data  in  Figure  10.  The  mean  responses  of  AOs  and  CHs  were 
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compared,  and  the  data  indicates  that  CHs  disagree  with  more  components  of  risk 
assessment  than  AOs.  The  AOs’  mean  response  for  survey  items  pertaining  to  risk 
assessment  was  3.56,  whereas  the  CHs’  mean  response  was  2.94. 


Figure  10.  Average  Response  for  Risk  Assessment  Component 

3.  Control  Activities 

The  highest  overall  mean  of  the  internal  control  components  was  for  control 
activities,  with  a  mean  of  3.78  as  shown  in  Figure  8,  and  that  finding  is  supported  by 
the  data  in  Figure  1 1 .  The  AOs’  mean  response  to  the  survey  items  pertaining  to 
control  activities  was  3.85  and  the  CHs’  was  3.7. 
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4. 


Information  and  Communication 


As  shown  in  Figure  8,  the  internal  control  component  information  and 
communication  had  the  second  lowest  overall  mean  with  3.45.  Figure  12  shows  the 
comparison  of  the  AOs’  mean  response  within  this  component  of  3.53  and  the  CHs’ 
mean  of  3.36. 


Figure  12.  Average  Response  for  Information  and  Communication 

Component 


5.  Monitoring  Activities 

The  monitoring  activities  component  had  an  overall  mean  of  3.5  as  shown  in 
Figure  8.  Figure  13  compares  the  AOs’  overall  mean  of  3.59  and  the  CFIs’  of  3.45. 
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Figure  13.  Average  Response  for  Monitoring  Activities  Component 

Table  2  presents  the  number  of  survey  items  within  each  of  the  five  internal 
control  components  and  the  mean  response  from  AOs  and  CHs  for  each 
component.  The  “I  don’t  know”  responses  were  not  calculated  in  the  mean. 
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Table  2.  Number  of  Survey  Items  and  Mean  Responses  From  AOs  and  CHs 
_ for  the  Five  Internal  Control  Components _ 


Internal  Control 
Component 

Number  of  Survey 
Items 

Mean  of 
Approving 
Officials 

Mean  of 
Cardholders 

Control  Environment 

17 

3.69 

3.47 

Risk  Assessment 

8 

3.56 

2.94 

Control  Activities 

14 

3.85 

3.70 

Information  and 
Communication 

16 

3.53 

3.36 

Monitoring  Activities 

14 

3.59 

3.45 

Total 

68 

The  mean  was  used  to  analyze  the  data  for  each  of  the  five  internal  control 
components  separately,  which  produced  one  mean  per  internal  control  component, 
as  shown  in  Figure  8.  In  addition,  the  mean  of  the  responses  from  AOs  and  CHs,  in 
relation  to  each  survey  item  within  each  component,  was  compared  to  identify  any 
differences  in  overall  responses  between  AOs  and  CHs. 

D.  ADDITIONAL  ANALYSIS 

From  additional  data  analysis,  survey  items  that  were  deemed  significant  or 
important  to  discuss  were  considered  noteworthy.  In  this  section,  the  frequency  and 
type  of  survey  items  to  which  participants  responded  “I  don’t  know”  are  identified  and 
discussed.  In  addition,  survey  items  are  addressed  by  individual  survey  item  as  well 
as  by  the  differences  in  means  between  AOs  and  CHs  based  on  newly  created 
criteria,  which  are  explained  within  each  section  of  analysis. 

1.  Analysis  of  “I  Don’t  Know”  Responses 

This  section  provides  analysis  of  the  “I  don’t  know”  responses.  The  “I  don’t 
know”  responses  indicated  possible  uncertainty  regarding  the  specific  survey  item, 
which  can  have  important  implications.  During  analysis  of  the  individual  survey  items 
within  each  component,  “I  don’t  know”  responses  were  coded  as  0  (zero  value).  The 
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“I  don’t  know”  responses  were  not  included  in  the  mean  calculations.  They  were 
converted  to  blanks  in  the  Excel  spreadsheet  and  were  identified  as  missing 
responses  in  SPSS.  Overall,  there  were  26  “I  don’t  know”  responses,  which  are 
referred  to  as  missing  responses. 

There  were  two  missing  responses  within  the  control  environment 
component.  Those  survey  items  related  to  the  discussion  of  performance  standards 
and  personal  conduct.  The  control  environment  component  had  the  least  uncertainty 
among  the  participants,  with  only  two  missing  responses.  Within  the  risk  assessment 
component,  there  were  four  missing  responses.  Those  survey  items  pertained  to 
pressure  to  get  the  job  done  and  staff  accountability.  An  analysis  of  the  control 
activities  component  revealed  that  there  were  also  four  missing  responses.  Those 
survey  items  pertained  to  the  span  of  control  for  the  oversight  of  the  GPCP, 
appropriate  consequences  to  those  who  break  laws  and  rules,  and  knowledge  of 
measures  in  place  to  block  certain  vendors. 

The  information  and  communication  component  had  nine  missing  responses. 
This  component  had  the  most  uncertainty  among  the  participants.  These  survey 
items  addressed  knowledge  of  employee  protection  for  reporting  impropriety, 
consequences  of  illegal/improper  use  of  the  purchase  card,  and  information 
systems’  provision  of  reports  to  management  on  a  unit’s  performance  related  to  its 
objectives.  One  possible  implication  of  the  relatively  high  number  of  “I  don’t  know” 
responses  is  that  important  information  may  not  be  disseminated;  therefore,  the 
employees  may  not  be  aware  of  existing  regulations.  The  monitoring  activities 
component  had  seven  missing  responses.  This  component  had  the  second  highest 
level  of  uncertainty  among  the  participants.  These  survey  items  were  regarding 
timely  follow-up  to  feedback  and  complaints,  policy  review  to  ensure  compliance, 
GPCP  monitoring  to  ensure  correct  span  of  control,  and  systems’  ability  to  prevent 
or  detect  missing  or  incorrect  information.  The  overall  implications  of  possible 
uncertainty  in  the  area  of  information  and  communication  are  addressed  later.  The 
next  section  provides  an  analysis  of  Agree  and  Disagree  categories  by  internal 
control  component. 

2.  Analysis  of  Agree  and  Disagree  Categories  by  Internai  Control 
Component 

This  section  discusses  the  additional  analysis  on  the  “agree  and  strongly 
agree”  and  the  “disagree  and  strongly  disagree”  responses,  based  on  newly  created 
categories  and  criteria.  To  determine  whether  responses  to  a  question  was 
interesting  to  note  for  individual  survey  items,  using  SPSS,  the  valid  percent  was 
calculated  for  each  of  the  five  response  options:  “strongly  agree,”  “agree,”  “neither 
agree  nor  disagree,”  “disagree,”  and  “strongly  disagree.”  Those  who  responded  “I 
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don’t  know”  were  not  included  in  the  valid  percent  calculation.  The  valid  percent 
calculation  was  based  on  only  the  actual  responses  for  each  particular  survey  item. 

The  valid  percents  for  “strongly  agree”  and  “agree”  were  combined  to  form 
category  “Agree,”  and  the  valid  percents  for  “strongly  disagree”  and  “disagree”  were 
also  combined  to  form  category  “Disagree.”  The  total  percentages  for  category 
“Agree”  and  for  category  “Disagree”  were  then  separated  into  three  sub-categories: 
(1)  greater  than  50%  but  less  than  75%,  (2)  greater  than  75%  but  less  than  100%, 
and  (3)  100%.  However,  only  the  survey  items  in  which  100%  of  the  participants 
agreed  or  more  than  50%  of  the  participants  disagreed  were  further  analyzed.  The 
response  for  “neither  agree  nor  disagree”  was  not  included  in  these  particular 
calculations. 

The  survey  items  that  fell  into  the  100%  agree  sub-category  and  into  the 
greater  than  50%  disagree  sub-category  are  identified  and  explained  in  each  internal 
control  component  section.  All  findings  were  practically  significant,  meaning  it  has 
valuable  implications  to  the  management  of  the  GPCP. 

a.  Control  Environment 

There  were  no  survey  items  that  fell  into  the  100%  agree  sub-category 
in  the  control  environment  component.  There  were,  however,  three  survey  items  that 
fell  into  the  greater  than  50%  disagree  sub-category.  More  than  50%  of  the 
participants  responded  that  an  atmosphere  of  mutual  trust  and  open  communication 
between  management  and  employees  had  not  been  established  within  the 
organization.  Also,  more  than  50%  of  the  participants  disagreed  on  whether  their 
work  units  were  cross-trained  so  that  they  could  fill  in  for  each  other  when 
necessary.  Furthermore,  more  than  50%  of  participants  responded  that  personnel 
turnover  has  impacted  their  units’  abilities  to  effectively  perform  their  functions. 


b.  Risk  Assessment 

The  one  risk  assessment  survey  item  that  100%  of  the  participants 
agreed  on  was  that  AOs  hold  their  staff  accountable;  however,  only  three  out  of  six 
AOs  responded  to  this  question.  The  missing  three  may  have  answered  “not 
applicable”;  however,  that  is  not  consistent  with  the  demographics  question  asking 
AOs  to  identify  how  many  people  they  oversaw.  There  were  no  survey  items  that  fell 
into  the  greater  than  50%  disagree  sub-category  in  the  risk  assessment  component. 


c.  Control  Activities 

Two  survey  items  within  control  activities  fell  into  the  100%  agree  sub¬ 
category.  One  hundred  percent  of  participants  agreed  that  they  were  discouraged 
from  sharing  their  computer  passwords  with  others.  In  addition,  100%  of  the 
participants  agreed  that  their  organization  effectively  established  processes  so  that 
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no  single  person  in  the  organization  buys,  receives,  and  certifies  funds  within  the 
purchase  card  program.  There  were  no  survey  items  that  fell  into  the  greater  than 
50%  disagree  sub-category  within  the  control  activities  component. 

d.  Information  and  Communication 

There  was  one  survey  item  that  fell  into  the  100%  agree  sub-category 
in  the  information  and  communications  component.  One  hundred  percent  of  the 
participants  agreed  that  they  knew  where  to  report  employee  misconduct.  There  was 
no  survey  item  that  fell  within  the  greater  than  50%  disagree  sub-category  within  this 
internal  control  component. 

e.  Monitoring  Activities 

There  was  only  one  question  that  fell  into  the  100%  agree  sub¬ 
category  in  the  monitoring  activities  component,  which  was  that  100%  of  participants 
knew  what  action  to  take  if  they  became  aware  of  unethical  or  fraudulent  activity. 
Additionally,  more  than  50%  of  participants  did  not  agree  that  internal  and/or 
external  feedback  and  complaints  were  followed  up  on  in  a  timely  and  effective 
manner.  The  next  section  provides  an  analysis  of  the  differences  in  means  between 
AOs  and  CHs. 

3.  Analysis  of  Differences  in  Means 

This  section  discusses  additional  analysis  on  the  differences  in  means 
between  AOs  and  CHs,  based  on  a  newly  created  category.  From  the  data  analysis, 
survey  items  that  were  deemed  significant  or  important  to  discuss  were  considered 
noteworthy.  During  analysis  of  the  individual  survey  items  within  each  component,  “I 
don’t  know”  responses  were  coded  as  0  (zero  value).  The  “I  don’t  know”  responses 
were  not  included  in  the  mean  calculations.  To  determine  if  the  difference  in  means 
by  survey  item  between  AOs  and  CHs  was  noteworthy,  the  difference  in  means 
between  AOs  and  CHs  was  calculated  using  SPSS.  If  the  difference  was  found  to  be 
greater  than  90%,  the  survey  item  was  deemed  noteworthy.  However;  all  findings 
were  practically  significant,  meaning  they  have  valuable  implications  to  the 
management  of  the  GPCP.  The  eight  survey  items  with  a  noteworthy  difference  in 
means  between  AOs  and  CHs  are  identified  below.  Of  the  eight  noteworthy 
differences,  seven  survey  items  indicated  that  CHs  responded  significantly  lower 
than  AOs,  whereas  only  one  question  indicated  that  AOs  responded  significantly 
lower  than  CHs. 

There  were  three  noteworthy  differences  in  the  risk  assessment  component 
where  CHs  responded  significantly  lower  than  AOs.  CHs  responded  that  they  felt 
unreasonable  pressure  to  get  the  job  done,  their  departments  did  not  identify 
barriers  or  resolve  issues  that  could  impact  achievement  objectives,  and  they  did  not 
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have  enough  time  in  the  day  to  get  the  job  done,  including  their  collateral  duties.  The 
third  survey  item  indicates  that  CHs  perceive  that  they  do  not  have  enough  time  to 
perform  their  GPCP  collateral  duties  along  with  their  regular  job  duties. 

There  were  also  three  noteworthy  differences  within  the  information  and 
communication  component  where  CHs  responded  significantly  lower  than  AOs.  CHs 
disagreed  that  their  information  systems  provided  management  with  timely  reports 
on  their  units’  performance  relative  to  objectives.  The  CHs  also  disagreed  that  the 
interaction  between  management  and  their  work  units  enabled  them  to  perform  their 
jobs  effectively.  Furthermore,  the  CHs  disagreed  that  management  was  aware  of 
their  business  units’  actual  performance. 

Finally,  there  were  two  noteworthy  differences  within  the  monitoring  activities 
component  where  AOs  responded  significantly  lower  than  CHs,  and  one  item  where 
CHs  responded  significantly  lower  than  AOs.  The  AOs  did  not  agree  that 
computerized  data  entry  systems  within  their  units  effectively  prevented  or  detected 
missing  information  and  CHs  disagreed  that,  in  their  absences,  a  qualified  CH  was 
available  as  a  backup  if  needed.  There  were  no  noteworthy  differences  in  means 
between  AOs  and  CHs  in  the  control  environment  or  the  control  activities  survey 
items. 

This  section  presented  an  analysis  of  “I  don’t  know”  responses.  An  analysis  of 
the  Agree  and  Disagree  categories  by  the  five  internal  control  components  and  an 
additional  analysis  of  the  difference  in  means  between  AOs  and  CHs  were 
presented.  The  next  section  provides  implications  of  findings  related  to  the  research 
questions. 

E.  IMPLICATIONS  OF  FINDINGS  RELATED  TO  RESEARCH  QUESTIONS 

The  purpose  of  the  research  was  to  answer  the  questions  below  through  the 
development  and  deployment  of  the  online  survey  as  well  as  the  analysis  of  the 
results. 


•  What  are  the  differences  in  perceptions  of  internal  controls  between 
the  approving  officials  and  cardholders  in  the  Government  Purchase 
Card  Program  at  the  Naval  Postgraduate  School? 

Based  on  the  analysis  of  the  results,  eight  significant  differences  in 
perceptions  between  AOs  and  CHs  were  identified  in  three  of  the  five  internal  control 
components:  risk  assessment,  information  and  communication,  and  monitoring 
activities. 

Within  the  risk  assessment  component,  the  following  significant  differences 
between  AOs  and  CHs  were  identified: 
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1 .  CHs  responded  that  they  did  not  have  enough  time  in  a  workday  to 
complete  their  duties,  including  collateral  duties,  whereas  AOs  did  not 
appear  to  have  this  perception. 

2.  CHs  felt  unreasonable  pressure  to  get  the  work  done,  whereas  AOs 
did  not  appear  to  have  this  perception. 

3.  CHs  responded  that  their  departments  did  not  identify  barriers  or 
resolve  issues  that  could  impact  achievement  of  department 
objectives,  whereas  AOs  did  not  appear  to  have  this  perception. 

Within  the  information  and  communication  component,  the  following 
significant  differences  between  AOs  and  CHs  were  identified: 

4.  CHs  responded  that  management  did  not  receive  timely  reports  on 
their  units’  performance  relative  to  their  objectives,  whereas  AOs  did 
not  appear  to  have  this  perception. 

5.  CHs  responded  that  interaction  between  management  and  their  units 
did  not  enable  them  to  do  their  jobs  effectively,  whereas  AOs  did  not 
appear  to  have  this  perception. 

6.  CHs  responded  that  management  was  not  informed  or  aware  of  their 
units’  actual  performance,  which  differs  significantly  from  the 
responses  from  AOs. 

Within  the  monitoring  activities  component,  the  following  significant 
differences  between  AOs  and  CHs  were  identified: 

7.  AOs’  responded  that  their  units’  computerized  systems  were  not  able 
to  effectively  prevent  or  detect  missing  and  incorrect  information,  which 
differed  from  CHs  perception. 

8.  CHs  did  not  agree  that  there  was  a  qualified  CH  available  as  a  backup 
to  meet  their  end  users’  needs  in  their  absences.  AOs,  on  the  other 
hand,  strongly  agreed  that  there  was  a  qualified  AO  available  as  a 
backup  in  their  absences. 

Overall,  the  means  for  each  internal  control  component  for  AOs  were 
consistently  higher  than  for  CHs.  This  finding  implies  that  AOs  generally  perceive  the 
strength  of  the  GPCP’s  internal  controls  to  be  stronger  than  the  CHs  perceive  them. 

•  What  are  the  implications  to  auditability  from  the  differences  in 
perceptions  of  internal  control  between  approving  officials  and 
cardholders  within  the  Government  Purchase  Card  Program  at  the 
Naval  Postgraduate  School? 
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Both  strong  and  weak  internal  controls  have  implications  on  auditability.  The 
analysis  identified  potential  implications  of  internal  controls,  or  lack  thereof,  on 
auditability  within  the  GPCP  at  NPS.  An  implication  of  the  differences  in  perceptions 
in  the  risk  assessment  component  is  that  GPCP  participants  may  be  rushed  to 
complete  the  job  in  order  to  meet  their  organization’s  goals.  This  could  lead  to 
making  mistakes  in  the  process,  increasing  the  vulnerability  for  possible  fraud, 
waste,  and  abuse,  and  hindering  the  organization’s  auditability  (GAO,  2008).  An 
implication  of  the  differences  in  perceptions  in  the  information  and  communication 
component  is  that  progress  and  objectives  are  possibly  not  being  measured,  and 
proper  oversight  may  not  be  present.  CHs  and  management  may  not  be 
communicating  effectively  to  achieve  the  best  results  for  the  organization.  If 
management  is  unaware  of  a  unit’s  performance,  it  may  hinder  them  from  making 
informed  decisions  for  the  organization. 

Another  implication  of  the  differences  in  perceptions  in  the  information  and 
communication  component  is  that  participants  appear  to  know  where  to  report 
suspected  wrong-doing  or  improprieties  and  appear  to  be  aware  of  the  potential 
consequences.  However,  the  results  indicate  that  majority  of  them  may  not  know  if 
management  ensures  appropriate  actions  after  the  initial  reporting.  If  management 
does  not  take  proper  action  against  wrong-doing  and  improprieties,  CHs  and  AOs 
may  not  take  management  or  the  potential  consequences  seriously.  An  implication 
of  the  differences  in  perceptions  in  the  monitoring  activities  component  is  from  the 
difference  of  perceptions  regarding  reliability  of  the  organization’s  computer 
systems.  If  the  organization  cannot  rely  on  the  unit’s  computerized  system,  the 
employee  must  have  comprehensive  knowledge  of  the  system  to  prevent  errors 
themselves,  and  if  they  rely  on  the  computer  system  which  may  be  unreliable,  it  may 
hinder  the  organization  from  becoming  auditable.  Finally,  if  qualified  people  are  not 
available  to  act  as  backups,  the  organization  would  not  be  able  to  support  its  end 
users.  The  absence  of  effective  internal  controls  can  expose  the  purchase  card 
program  to  inefficiencies  and  vulnerabilities  to  fraud,  which  would  impact  auditability 
in  the  organization.  The  next  section  provides  recommendations  based  on  the  data 
analysis. 

F.  RECOMMENDATIONS  BASED  ON  DATA  ANALYSIS 

The  recommendations  based  on  the  data  analysis  of  the  five  components  of 
internal  control  and  the  implications  of  differences  in  perceptions  between  AOs  and 
CHs  are  presented  below. 

1.  Strengthen  the  Organization’s  Controi  Environment 

In  order  to  be  a  productive  organization,  management  needs  to  maintain 
ethical  values  and  cultivate  trust  with  their  employees.  Although  the  management 
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personnel  in  the  GPCP  may  not  be  the  AOs,  who  are  direct  supervisors  of  the  CHs, 
it  is  imperative  to  act  with  integrity  and  strong  ethical  values  to  set  an  example  for 
those  who  work  within  the  GPCP.  Based  on  the  data  analysis,  there  may  be  a  lack 
of  mutual  trust  and  open  communication  between  management  and  employees. 
Management  should  ensure  that  their  communication  plan  and  organizational  goals 
are  transparent  and  communicated  throughout  the  organization.  In  addition,  the 
reporting  relationships  should  be  clearly  identified  so  employees  may  feel 
comfortable  communicating  with  their  supervisor  and  other  management  personnel. 
This  may  increase  employees’  trust  and  open  communication  with  management. 

Another  aspect  of  the  control  environment  that  should  be  addressed  is  the 
formal  codes  and  policies  that  communicate  ethical  behavior  and  standards.  A 
weakness  identified  by  the  data  analysis  is  that  employees  may  not  have  known  the 
penalties  of  unacceptable  behavior  or  if  prompt  action  is  taken  when  there  is 
improper  use  of  the  purchase  card.  The  codes  of  ethics  and  integrity  should  be 
periodically  reviewed  and  acknowledged  by  signature  from  all  employees.  In 
addition,  management  should  clearly  communicate  and  disseminate  information 
regarding  processing  and  handling  of  an  incident  with  the  purchase  card. 

2.  Enhance  Communication 

Information  and  communication  should  be  taken  seriously,  so  it  is  imperative 
to  clearly  communicate  the  organization’s  mission,  expectations,  and  strategies  to  all 
employees.  The  data  analysis  identified  several  areas  of  weaknesses  within  the 
information  and  communication  component;  therefore,  several  recommendations  are 
made  to  enhance  communication  within  the  GPCP.  A  message  regarding  the 
GPCP’s  organizational  structure  and  objectives  should  be  generated  out  to  AOs  and 
CHs,  and  it  should  be  clearly  stated  so  that  there  are  no  misunderstandings  or 
miscommunications.  To  increase  understanding  of  the  organization,  management 
should  also  encourage  AOs  and  CHs  to  read  the  existing  policies  and  procedures 
regarding  the  GPCP,  if  they  have  not  done  so  before.  In  addition,  management 
should  review  changes  to  policies  and  procedures  in  both  AOs’  and  CHs’  meetings 
to  generate  a  clear,  unified  message. 

Furthermore,  CHs  responded  that  interaction  between  management  and  their 
units  did  not  enable  them  to  do  their  jobs  effectively.  This  may  be  an  area  of 
improvement  for  management  to  continue  communicating  clear  objectives  and 
maintain  flexibility  to  enable  CHs  to  do  their  job  effectively.  If  a  CHs’  AO  is 
preventing  them  from  doing  their  job  effectively,  there  should  be  a  means  of 
communication  outside  of  a  direct  supervisor.  If  an  alternate  line  of  communication  is 
available,  that  information  should  be  disseminated  to  all  employees. 
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Finally,  the  purpose  of  information  and  communication  is  to  distribute 
information  at  the  right  time  and  to  the  right  people  in  order  to  carry  out  roles  and 
responsibilities.  An  identified  potential  weakness  is  that  management  may  not  be 
informed  of  their  units’  performance.  Management  may  be  unable  to  make  the  most 
informed  decision  if  they  are  unaware  of  their  employees’  units’  actual  performance 
and  do  not  receive  timely  reports.  In  order  to  strengthen  that  perceived  weakness,  a 
report  or  spreadsheet  should  be  provided  to  management  with  weekly  or  monthly 
progress  based  on  objectives  set  by  the  unit  or  the  GPCP.  It  is  imperative  that 
management  receives  operating  information  to  determine  the  organization’s  level  of 
compliance  with  laws  and  regulations.  Ensuring  that  the  units’  data  and  performance 
measures  are  valid  and  reliable  is  crucial  to  making  informed  decisions. 

3.  Realign  Government  Purchase  Card  Program  Structure 

The  GPCP  organizational  structure  should  be  realigned  to  balance  the 
number  of  departments  and  number  of  people  that  each  CH  supports.  The  data 
analysis  indicated  that  38%  of  participants,  all  of  whom  were  CHs,  spent  75%  of 
their  working  hours  conducting  GPCP  collateral  duties.  In  addition,  CHs  responded 
that  they  felt  unreasonable  pressure  to  get  the  job  done,  and  they  did  not  have 
enough  time  in  the  day  to  perform  all  their  duties,  including  collateral  duties.  To 
increase  productivity,  the  program  structure  should  identify  the  CHs  who  may  be 
overworked  and  spending  more  than  half  their  working  day  on  GPCP  collateral 
duties,  and  reorganize  it  to  balance  the  purchasing  support.  The  organization  should 
ensure  that  CHs  receive  clear  objectives  and  have  a  reasonable  amount  of  time  to 
complete  their  duties,  including  collateral  duties.  This  recommendation  may  increase 
productivity  in  both  the  CH’s  primary  and  collateral  duties. 

Furthermore,  another  recommendation  for  realigning  the  GPCP  structure  is  to 
ensure  all  AOs  and  CHs  are  properly  trained  and  equipped  with  the  necessary  tools 
and  information  to  achieve  their  goals.  In  order  to  maintain  productivity  and  achieve 
their  units’  objectives  in  the  absence  of  an  AO  or  CH,  information  should  be 
available  to  the  units’  end  users  regarding  points  of  contact  and  proper  procedures 
that  should  be  followed  in  their  absence.  Each  unit  may  not  have  more  than  one  CH; 
therefore,  the  organization  should  also  ensure  that  all  pertinent  information  is 
available  to  both  AOs  and  CHs  when  needed. 

G.  SUMMARY 

In  this  chapter,  the  results  of  the  online  survey  collected  from  LimeSurvey 
were  presented,  which  included  survey  items  pertaining  to  demographics  and  the 
five  components  of  internal  control.  The  overall  population’s  mean  of  the  Likert- 
based  responses  in  addition  to  the  frequency  of  the  demographics  survey  items 
were  identified.  The  mean  for  each  of  the  five  internal  control  components  were  also 
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calculated  and  presented.  The  mean  and  frequency  of  responses  from  the  AOs  and 
CHs  were  compared  and  analyzed  to  identify  any  differences  in  perceptions  to 
internal  controls  between  AO  and  CH.  Additional  analysis  based  on  the  results  was 
discussed.  Furthermore,  any  potential  implications  of  internal  controls,  or  lack 
thereof,  on  auditability  within  the  Government  Purchase  Card  Program  (GPCP)  at 
the  Naval  Postgraduate  School  (NPS)  were  addressed.  Finally,  recommendations 
based  on  the  data  analysis  were  presented. 
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VI.  SUMMARY,  CONCLUSIONS,  AND  AREAS  FOR  FURTHER 

RESEARCH 


A.  SUMMARY 

The  Department  of  Defense  (DoD)  and  the  Department  of  the  Navy  (DoN) 
purchase  card  programs  process  hundreds  of  thousands  of  transactions  accounting 
for  billions  of  dollars  annually.  In  2013,  the  federal  government’s  300,900 
cardholders  (CHs)  spent  $16.5  billion  on  18.9  million  transactions  (GSA,  n.d.-c).  In 
FY2012,  the  Naval  Postgraduate  School  (NPS)  Government  Purchase  Card 
Program  (GPCP)  was  responsible  for  making  approximately  21,000  transactions 
totaling  approximately  $24.2  million  (M.  Morales,  personal  communication,  July  24, 
2013).  Approving  Officials  (AOs)  and  CHs  play  an  important  role  in  the  success  of 
the  GPCP.  Additionally,  in  order  for  the  GPCP  to  be  successful,  there  must  be 
sufficient  corporate  governance,  specifically  effective  internal  controls  and 
auditability.  The  purpose  of  this  research  was  to  determine  whether  there  were 
differences  in  perceptions  between  AOs  and  CHs  regarding  internal  controls  within 
the  GPCP  at  NPS. 


B.  CONCLUSIONS 

Although  there  were  slight  differences  in  the  survey  item  means  between  AOs 
and  CHs,  there  is  still  practical  significance  to  all  of  the  findings.  The  AOs 
consistently  responded  higher  than  the  CHs  with  regard  to  the  five  internal  control 
components.  This  section  briefly  provides  conclusions  as  they  relate  to  the  research 
questions. 

•  What  are  the  differences  in  perceptions  of  internal  controls  between 
the  approving  officials  and  cardholders  in  the  Government  Purchase 
Card  Program  at  the  Naval  Postgraduate  School? 

There  were  slight  differences  of  perceptions  of  internal  control  between  AOs 
and  CHs  within  each  of  the  five  internal  control  components.  However,  there  were 
eight  significant  differences  in  perceptions  of  internal  controls  between  AOs  and 
CHs.  They  were  identified  in  three  of  the  five  internal  control  components:  risk 
assessment,  information  and  communication,  and  monitoring  activities.  The 
research  findings  revealed  that  AOs  consistently  responded  more  positively  to 
internal  controls  in  the  five  internal  control  components  than  CHs,  implying  that  AOs 
perceive  the  strength  of  the  internal  controls  to  be  stronger  than  the  CHs  perceive 
them  to  be  within  the  NPS  GPCP. 

•  What  are  the  implications  to  auditability  from  the  differences  in 
perceptions  of  internal  control  between  approving  officials  and 
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cardholders  within  the  Government  Purchase  Card  Program  at  the 
Naval  Postgraduate  School? 

Both  strong  and  weak  internal  controls  have  implications  on  auditability. 

There  were  survey  items  to  which  both  AOs  and  CHs  responded  strongly  agree, 
which  included  such  things  as  password  protection,  separation  of  duties,  and 
adequate  fraud  education.  However,  the  absence  of  effective  internal  controls  can 
expose  the  purchase  card  program  to  inefficiencies  and  vulnerabilities  to  fraud, 
which  would  impact  auditability  in  the  organization.  Weaknesses  mentioned  in  the 
implications  of  findings  could  lead  to  employee’s  making  mistakes  somewhere  along 
the  process,  creating  possible  fraud,  waste,  and  abuse,  and  further  hindering  the 
organization’s  auditability.  Any  differences  in  perceptions  between  AOs  and  CHs  can 
have  an  impact  on  auditability  within  the  GPCP.  The  following  section  suggests 
areas  for  further  research. 

C.  AREAS  FOR  FURTHER  RESEARCH 

The  following  areas  for  further  research  are  suggested: 

One  area  for  further  research  is  to  expand  the  survey  to  other  DoN 
organizations  to  analyze  the  differences  in  perceptions  of  internal  controls  within  the 
organizations’  purchase  card  program.  The  expansion  of  the  survey  population 
would  provide  more  data  and  potentially  identify  similar  perceived  trends  within  each 
organization’s  purchase  card  program.  In  addition,  this  research  would  potentially 
provide  insight  into  each  organization’s  internal  control  system  and  identify  the 
strongest  and  weakest  components  of  internal  control. 

Another  area  for  further  research  would  be  to  expand  the  potential  survey 
participants  at  NPS  to  include  purchasing  agents  within  the  contracting  office.  This 
addition  would  increase  the  number  of  potential  participants  and  provide  additional 
information  from  those  who  purchase  full-time  and  have  warrants  for  purchases 
greater  than  $150,000.  This  line  of  research  would  allow  for  a  more  diverse  analysis 
between  the  perceptions  of  AOs,  CHs,  and  purchasing  agents. 
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10  U.S.C.  §2784  (2014). 
31  U.S.C  §3512  (2011). 
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APPENDIX  A.  INDUSTRY  P-CARD  PROCESS 
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Figure  A1.  Industry  P-Card  Process 

(NAPCP,  2013b) 
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APPENDIX  B.  COSO’S  17  FUNDAMENTAL  PRINCIPLES 
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Figure  B1.  COSO’s  17  Fundamental  Principles 

(Adapted  from  COSO,  2013;  Tan,  2013) 
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